{ "generado": "2026-11-15T13:46:32-03:00", "fuentes": [ "ThreatFox (abuse.ch)", "URLhaus (abuse.ch)" ], "licencia": "CC0 según abuse.ch; atribución apreciada", "chile": [ { "ioc": "fumivet.cl", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 50, "first_seen": "2026-11-15 10:38", "source": "ThreatFox" }, { "ioc": "cafedelmuseo.cl", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 50, "first_seen": "2026-11-15 08:29", "source": "ThreatFox" }, { "ioc": "dux.aprendizajeeslibertad.cl", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 05:05", "source": "ThreatFox" }, { "ioc": "www.fumivet.cl", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 04:30", "source": "ThreatFox" }, { "ioc": "fot.aprendizajeeslibertad.cl", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 04:05", "source": "ThreatFox" }, { "ioc": "nv.aprendizajeeslibertad.cl", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 03:05", "source": "ThreatFox" }, { "ioc": "inn.aprendizajeeslibertad.cl", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 02:05", "source": "ThreatFox" }, { "ioc": "xp.aprendizajeeslibertad.cl", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 01:05", "source": "ThreatFox" }, { "ioc": "aprendizajeeslibertad.cl", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 00:05", "source": "ThreatFox" }, { "ioc": "k0f.aprendizajeeslibertad.cl", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 00:05", "source": "ThreatFox" }, { "ioc": "apegotienda.cl", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "xsurf.cl", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" } ], "recientes": [ { "ioc": "telun.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-15 12:05", "source": "ThreatFox" }, { "ioc": "bj.apibet99.net", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 12:05", "source": "ThreatFox" }, { "ioc": "154.94.232.212:21128", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 100, "first_seen": "2026-11-15 12:05", "source": "ThreatFox" }, { "ioc": "209.42.27.55:443", "type": "ip:port", "threat": "botnet_cc", "malware": "NjRAT", "confidence": 100, "first_seen": "2026-11-15 12:05", "source": "ThreatFox" }, { "ioc": "http://wienu.com/swat/gate.php", "type": "url", "threat": "botnet_cc", "malware": "Pony", "confidence": 100, "first_seen": "2026-11-15 12:05", "source": "ThreatFox" }, { "ioc": "http://113.53.69.133:42068/bin.sh", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 12:04", "source": "URLhaus" }, { "ioc": "http://175.43.40.83:51473/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 12:02", "source": "URLhaus" }, { "ioc": "http://5.26.99.14:42030/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 12:02", "source": "URLhaus" }, { "ioc": "http://61.54.40.75:57440/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 12:02", "source": "URLhaus" }, { "ioc": "http://113.53.69.164:51286/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 12:02", "source": "URLhaus" }, { "ioc": "http://77.53.231.107:56450/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 12:02", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/mpathroliya/College-Management-System/refs/heads/master/database/Management-College-System-1.1.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-15 12:01", "source": "URLhaus" }, { "ioc": "https://fastsetup.lol/7qabzvva.rar", "type": "url", "threat": "malware_download", "malware": "fastsetup-lol, ua-wget", "confidence": 100, "first_seen": "2026-11-15 12:01", "source": "URLhaus" }, { "ioc": "http://192.162.199.249/9yrba1w", "type": "url", "threat": "malware_download", "malware": "192-162-199-249, ua-wget", "confidence": 100, "first_seen": "2026-11-15 12:01", "source": "URLhaus" }, { "ioc": "446bb0d1935fe3ca3e83d7af92f272074c90df0f21929094fadca1fc88d9637b", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "ccc6103d6ac8a4cc668896e5cbfd896f398129d2637d73366ae8861c7274c6bf", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "898fa40b94235f7ba52989ecd80a26ec138da432064861aff53c2847780677f6", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "0fcd43599591000c1dddeab67cf80ad8000fa00330dc6886c842a17a431fc48e", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "a58d73918bfa791f170574476d404933a95b1fd571d36998fc9d247e3d321c8a", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "06846d3cf8f2adca94f5fff8d54679b3fe6c6c7f422c12f3833b9ef89db4c933", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "3253c2a0ded7fa349166fd8cebf51635449dc365e9ff23d90064c5629af8be20", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "399474159cc7388118076ec5b41cbcbf3700fe6f2a208a0ffc90e139237ec1a5", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "7a6369ff5105c609808fcd357d5b133ea6628b8cc0c047b4cd45091d2f60fb2c", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "5fadf2f38d7a8ecf55eedeb0b780f90ec8b311e9e7b994fa62994f03445a9c27", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "1afc22181879c503b24cecbf14bca3262428816ec4dd2ab56858cd84bcb51985", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "f65e2c7f80b8b3d6a23f0a0fed5cac2cd3a07d5edc7a4bdb7141d335f44ac18a", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "27fd2c873a20fc479f406df1e0b92637c8c5f7879a44a9802abadef050bc2c2e", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "7341f8a6dddda450894f6cfd5d27ef5b566ed0dd561dc3078f83587684849d92", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "61e970e007f4287a61a90279a3d5b389b52b8399dbc4fe989101939941591c2e", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "40c28d537cc00dc219affafd2c6ffec2431d8031f90e88504726752845a10de6", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "6529d2bb75e932a440f40317847571e2a2b3d96c07d6613b588d43224159188a", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "b23dbaa123787c0c014f605e9bc2820bf4700aa30461891450b24567966502c9", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "d8c39d59b3669a9231c170b2fb38858b996b29f97d7a70cf968f3e5665b759b8", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "10bb2df862c55d400453bd615fe679876e6971ee32c4f6b38dd72715d7adc1d8", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "a821c692fb49fb5dc1764b695fd075766866faa36c5c7f772ec9e89072c6d220", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "f2ae068a14935ac7d9b12f2f885033f14a2b98f25b228790ed5c2addc1005663", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "cb414685f6067f645788c5055ab5c9a3c1ae3f4689d6361a3e8fb6cf57a1d497", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "a8a6b532d74ef30bc28538a5786bb7f98be34d9051c1a81a2a5ea210ebd91b76", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "bd78d2adbe445bd202f27b07058e72c1793f23e216e1f293e0e786766ea25648", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "2bda9adfff9a4b6819788075a49a735e58d620b846c7a692a8b46f0e6fa60c05", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "5e9d63371293173bf1645daed0efa54034bf3708c29e0ba135a4f53dd10680d3", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "980761c0fec6cb3427a9d70e21eb71b6aa864693dda011ddd124355d0fd8a278", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "85871c2b173450401d47c33def4f37d142a458e86be0f9b74c3c0ec3462efeb9", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "4acd6d67cb5ad121f7efe05d378a882119aabf0bd8c01561f0f8aeecc7f8fcc6", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "b1063de91ae2d3128d63387e461a114ff71c5678a6cb6ff5cd19f1d349c57b3f", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "10b691863ca9d7afe108ed871eea6559ba34c77e691461855a7c3671158a4b89", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "405ea2b20c5a140cc4e87c8801e61738c6df4486a9bc4fdab327cffae7e3df81", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "eb97a5c156b8ff1e915732375c735e990ef10e2038d6928eafe6ec97e766e5b9", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "e67a35a0e25ff9d4212f866cf95aa031e80e1c60d7137a5f1ce5a7cdef572fcf", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:59", "source": "ThreatFox" }, { "ioc": "c2336a7bbe78bd081a9b1cfb204aae332a9e67506b7a147f7ec181d5751bb7d1", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:58", "source": "ThreatFox" }, { "ioc": "68e518bb24a1dbf4271b3aac54526116929aecd5562b3d2c2c058a23d4375ddf", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:58", "source": "ThreatFox" }, { "ioc": "29cc2133a9fafd64d9eaa94d5f281a7da6621f7f55630fd3de33baa7d72a5070", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:58", "source": "ThreatFox" }, { "ioc": "eb00fac5157b1919e0daec3c0091faba3046a2e8d23dcf532db98828232a4d97", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:58", "source": "ThreatFox" }, { "ioc": "c82ef18e7bac79d3d340071afdbd43564100ec8777d7bd1c3f0d0dc3cf16d6ca", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:58", "source": "ThreatFox" }, { "ioc": "ede5d5f6eb0710ef46b86774ff1ff74a486ad9b92a04143e92af78fed09b8197", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:58", "source": "ThreatFox" }, { "ioc": "345d0cf00f7db7a328da1e184e5a1284e2dc7db74fc93e1781f7c726738955a4", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 11:58", "source": "ThreatFox" }, { "ioc": "www.survane.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 11:56", "source": "ThreatFox" }, { "ioc": "http://175.153.129.217:49961/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:47", "source": "URLhaus" }, { "ioc": "http://182.127.176.6:41758/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:47", "source": "URLhaus" }, { "ioc": "http://45.204.146.120/iran.m68k", "type": "url", "threat": "malware_download", "malware": "45-204-146-120, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:43", "source": "URLhaus" }, { "ioc": "http://45.204.146.120/iran.sparc", "type": "url", "threat": "malware_download", "malware": "45-204-146-120, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:43", "source": "URLhaus" }, { "ioc": "http://45.204.146.120/iran.sh4", "type": "url", "threat": "malware_download", "malware": "45-204-146-120, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:43", "source": "URLhaus" }, { "ioc": "http://45.204.146.120/iran.i486", "type": "url", "threat": "malware_download", "malware": "45-204-146-120, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:42", "source": "URLhaus" }, { "ioc": "http://45.204.146.120/cat.sh", "type": "url", "threat": "malware_download", "malware": "45-204-146-120, sh, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:42", "source": "URLhaus" }, { "ioc": "http://45.204.146.120/iran.mipsrouter", "type": "url", "threat": "malware_download", "malware": "45-204-146-120, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:42", "source": "URLhaus" }, { "ioc": "http://45.204.146.120/iran.mips", "type": "url", "threat": "malware_download", "malware": "45-204-146-120, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:42", "source": "URLhaus" }, { "ioc": "http://45.204.146.120/iran.armv4l", "type": "url", "threat": "malware_download", "malware": "45-204-146-120, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:42", "source": "URLhaus" }, { "ioc": "http://45.204.146.120/iran.powerpc", "type": "url", "threat": "malware_download", "malware": "45-204-146-120, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:42", "source": "URLhaus" }, { "ioc": "http://45.204.146.120/iran.arc", "type": "url", "threat": "malware_download", "malware": "45-204-146-120, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:42", "source": "URLhaus" }, { "ioc": "http://45.204.146.120/iran.mipsel", "type": "url", "threat": "malware_download", "malware": "45-204-146-120, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:42", "source": "URLhaus" }, { "ioc": "http://45.204.146.120/iran.armv6l", "type": "url", "threat": "malware_download", "malware": "45-204-146-120, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:42", "source": "URLhaus" }, { "ioc": "http://45.204.146.120/iran.armv7l", "type": "url", "threat": "malware_download", "malware": "45-204-146-120, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:42", "source": "URLhaus" }, { "ioc": "http://45.204.146.120/iran.aarch64", "type": "url", "threat": "malware_download", "malware": "45-204-146-120, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:42", "source": "URLhaus" }, { "ioc": "http://45.204.146.120/iran.armv5l", "type": "url", "threat": "malware_download", "malware": "45-204-146-120, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:42", "source": "URLhaus" }, { "ioc": "http://45.204.146.120/iran.x86_64", "type": "url", "threat": "malware_download", "malware": "45-204-146-120, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:42", "source": "URLhaus" }, { "ioc": "http://45.204.146.163/tadashi.arm8", "type": "url", "threat": "malware_download", "malware": "45-204-146-163, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:41", "source": "URLhaus" }, { "ioc": "http://45.204.146.163/tadashi.ppc", "type": "url", "threat": "malware_download", "malware": "45-204-146-163, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:41", "source": "URLhaus" }, { "ioc": "http://45.204.146.163/tadashi.arm64", "type": "url", "threat": "malware_download", "malware": "45-204-146-163, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:41", "source": "URLhaus" }, { "ioc": "http://45.204.146.163/tadashi.arm5", "type": "url", "threat": "malware_download", "malware": "45-204-146-163, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:40", "source": "URLhaus" }, { "ioc": "http://45.204.146.163/tadashi.arm6", "type": "url", "threat": "malware_download", "malware": "45-204-146-163, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:40", "source": "URLhaus" }, { "ioc": "http://45.204.146.163/tadashi.arm7", "type": "url", "threat": "malware_download", "malware": "45-204-146-163, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:40", "source": "URLhaus" }, { "ioc": "http://45.204.146.163/tadashi.mpsl", "type": "url", "threat": "malware_download", "malware": "45-204-146-163, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:40", "source": "URLhaus" }, { "ioc": "http://45.204.146.163/tadashi.x86_64", "type": "url", "threat": "malware_download", "malware": "45-204-146-163, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:40", "source": "URLhaus" }, { "ioc": "http://45.204.146.163/tadashi.arm4", "type": "url", "threat": "malware_download", "malware": "45-204-146-163, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:40", "source": "URLhaus" }, { "ioc": "http://45.204.146.163/tadashi.x86", "type": "url", "threat": "malware_download", "malware": "45-204-146-163, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:40", "source": "URLhaus" }, { "ioc": "http://45.204.146.163/tadashi.mips", "type": "url", "threat": "malware_download", "malware": "45-204-146-163, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:40", "source": "URLhaus" }, { "ioc": "agriculturaltoursvalencia.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 11:36", "source": "ThreatFox" }, { "ioc": "http://5.83.134.37:5001/x86", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:35", "source": "URLhaus" }, { "ioc": "http://5.83.134.37:5001/amd64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:35", "source": "URLhaus" }, { "ioc": "http://5.83.134.37:5001/mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:35", "source": "URLhaus" }, { "ioc": "http://5.83.134.37:5001/bot.exe", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:35", "source": "URLhaus" }, { "ioc": "http://5.83.134.37:5001/i386", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:35", "source": "URLhaus" }, { "ioc": "http://5.83.134.37:5001/android_arm", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:35", "source": "URLhaus" }, { "ioc": "http://5.83.134.37:5001/arm5", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:35", "source": "URLhaus" }, { "ioc": "http://5.83.134.37:5001/android_arm64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:35", "source": "URLhaus" }, { "ioc": "http://5.83.134.37:5001/arm6", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:35", "source": "URLhaus" }, { "ioc": "http://5.83.134.37:5001/arm", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:35", "source": "URLhaus" }, { "ioc": "http://5.83.134.37:5001/mipsle", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:35", "source": "URLhaus" }, { "ioc": "http://5.83.134.37:5001/armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:35", "source": "URLhaus" }, { "ioc": "http://5.83.134.37:5001/arm64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:35", "source": "URLhaus" }, { "ioc": "https://donttreadtoken.com/plugins/linux.bin", "type": "url", "threat": "malware_download", "malware": "CoinMiner, elf, xmrig", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "http://45.204.146.30/fvbig/zerobot.arm64", "type": "url", "threat": "malware_download", "malware": "45-204-146-30, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "http://45.204.146.30/fvbig/zerobot.i686", "type": "url", "threat": "malware_download", "malware": "45-204-146-30, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "http://45.204.146.30/fvbig/zerobot.arm6", "type": "url", "threat": "malware_download", "malware": "45-204-146-30, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "http://45.204.146.30/fvbig/zerobot.mpsl", "type": "url", "threat": "malware_download", "malware": "45-204-146-30, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "http://45.204.146.30/fvbig/zerobot.arm", "type": "url", "threat": "malware_download", "malware": "45-204-146-30, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "http://45.204.146.30/fvbig/zerobot.ppc", "type": "url", "threat": "malware_download", "malware": "45-204-146-30, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "http://45.204.146.30/fvbig/zerobot.spc", "type": "url", "threat": "malware_download", "malware": "45-204-146-30, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "http://45.204.146.30/fvbig/zerobot.arm7", "type": "url", "threat": "malware_download", "malware": "45-204-146-30, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "http://45.204.146.30/fvbig/zerobot.mips", "type": "url", "threat": "malware_download", "malware": "45-204-146-30, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "http://45.204.146.30/fvbig/zerobot.m68k", "type": "url", "threat": "malware_download", "malware": "45-204-146-30, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "http://45.204.146.30/fvbig/zerobot.sh4", "type": "url", "threat": "malware_download", "malware": "45-204-146-30, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "http://45.204.146.30/fvbig/zerobot.arc", "type": "url", "threat": "malware_download", "malware": "45-204-146-30, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "http://casasmediterraneas.com/wp-content/plugins/linux.bin", "type": "url", "threat": "malware_download", "malware": "CoinMiner, compromised-site, elf, xmrig", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "http://45.204.146.30/fvbig/zerobot.x86_64", "type": "url", "threat": "malware_download", "malware": "45-204-146-30, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "http://45.204.146.30/fvbig/zerobot.arm5", "type": "url", "threat": "malware_download", "malware": "45-204-146-30, elf, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "http://5.83.134.37:5001/bins.sh", "type": "url", "threat": "malware_download", "malware": "honeypot, iot", "confidence": 100, "first_seen": "2026-11-15 11:33", "source": "URLhaus" }, { "ioc": "globalnick.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-15 11:32", "source": "ThreatFox" }, { "ioc": "http://112.232.70.255:39061/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:32", "source": "URLhaus" }, { "ioc": "http://42.234.216.248:50152/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:32", "source": "URLhaus" }, { "ioc": "http://182.119.71.1:35559/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:32", "source": "URLhaus" }, { "ioc": "http://61.163.147.33:37343/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:32", "source": "URLhaus" }, { "ioc": "sigmon-zz.mom", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 85, "first_seen": "2026-11-15 11:31", "source": "ThreatFox" }, { "ioc": "xiongying990kk099.com", "type": "domain", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 85, "first_seen": "2026-11-15 11:31", "source": "ThreatFox" }, { "ioc": "wooocommerce.shopping", "type": "domain", "threat": "payload_delivery", "malware": "Remus", "confidence": 85, "first_seen": "2026-11-15 11:31", "source": "ThreatFox" }, { "ioc": "http://45.204.146.44/iranbot-ultimate.armv4l", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:29", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/iranbot-ultimate.mipsel", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:29", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/iran.sparc", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:29", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/iranbot-ultimate.aarch64", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:29", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/iran.x86_64", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:29", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/iranbot-ultimate.mips", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:29", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/iran.armv5l", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:28", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/iran.mips", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:28", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/iran.sh4", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:28", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/telnet.sh", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, GBR, geofenced, sh, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:28", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/iran.powerpc", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:28", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/iran.mipsrouter", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:28", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/iran.mipsel", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:28", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/iranbot-ultimate.x86_32", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:28", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/cat.sh", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, GBR, geofenced, sh, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:28", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/iran.armv7l", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:28", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/iran.arc", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:28", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/iran.armv6l", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:28", "source": "URLhaus" }, { "ioc": "http://45.204.146.44/iran.m68k", "type": "url", "threat": "malware_download", "malware": "45-204-146-44, elf, GBR, geofenced, ua-wget", "confidence": 100, "first_seen": "2026-11-15 11:28", "source": "URLhaus" }, { "ioc": "http://175.153.129.217:49961/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:17", "source": "URLhaus" }, { "ioc": "http://119.102.88.141:43741/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:17", "source": "URLhaus" }, { "ioc": "http://27.205.158.201:56311/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:17", "source": "URLhaus" }, { "ioc": "http://120.28.252.64:49909/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:17", "source": "URLhaus" }, { "ioc": "http://182.127.176.6:41758/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:17", "source": "URLhaus" }, { "ioc": "www.pastificioilmattarello.it", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 11:16", "source": "ThreatFox" }, { "ioc": "www.oregudvarhaz.eu", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 11:16", "source": "ThreatFox" }, { "ioc": "www.pantaukorupsi.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 11:16", "source": "ThreatFox" }, { "ioc": "https://cdn.discordapp.com/attachments/1569863741833482343/1571527434040512592/fcc5d2080e?ex=6afb0e79&is=6af9bcf9&hm=a1beaacf37d0f84f369464492499509fa4672c1559fa40a5cc79443f7512c89f&", "type": "url", "threat": "malware_download", "malware": "IRAHook", "confidence": 100, "first_seen": "2026-11-15 11:12", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/horizon.x86", "type": "url", "threat": "malware_download", "malware": "elf, mirai", "confidence": 100, "first_seen": "2026-11-15 11:10", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/horizon.arm", "type": "url", "threat": "malware_download", "malware": "elf, mirai", "confidence": 100, "first_seen": "2026-11-15 11:09", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/horizon.arm6", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 11:09", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/a.arm7", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 11:08", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/a.arm", "type": "url", "threat": "malware_download", "malware": "elf, mirai", "confidence": 100, "first_seen": "2026-11-15 11:08", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/horizon.i686", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 11:08", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/horizon.arm7", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 11:08", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/horizon.mpsl", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 11:08", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/horizon.mips", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 11:08", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/horizon.m68k", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 11:08", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/horizon.ppc", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 11:08", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/a.x86", "type": "url", "threat": "malware_download", "malware": "elf, mirai", "confidence": 100, "first_seen": "2026-11-15 11:08", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/a.i686", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 11:08", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/a.mpsl", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 11:08", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/horizon.sh4", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 11:08", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/horizon.arm5", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 11:08", "source": "URLhaus" }, { "ioc": "http://181.215.115.186/bins/a.arm5", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 11:08", "source": "URLhaus" }, { "ioc": "wl.aradi777.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 11:05", "source": "ThreatFox" }, { "ioc": "z.gg018.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 11:05", "source": "ThreatFox" }, { "ioc": "http://61.163.147.33:37343/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:02", "source": "URLhaus" }, { "ioc": "http://42.232.229.247:37192/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:02", "source": "URLhaus" }, { "ioc": "http://5.165.98.235:19825/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 11:02", "source": "URLhaus" }, { "ioc": "17999a546763aa0690a2b3e2a8076a81ad8cd25ff511398839690f8822022a8e", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-15 10:58", "source": "ThreatFox" }, { "ioc": "www.remuvr.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 10:56", "source": "ThreatFox" }, { "ioc": "http://120.28.199.24:39497/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-15 10:55", "source": "URLhaus" }, { "ioc": "klopasnarhia.cc", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-15 10:48", "source": "ThreatFox" }, { "ioc": "hulahoopproft.cc", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-15 10:48", "source": "ThreatFox" }, { "ioc": "vuchicpidar.cc", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-15 10:48", "source": "ThreatFox" }, { "ioc": "glomuzop.cc", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-15 10:48", "source": "ThreatFox" }, { "ioc": "globalprotextetx.cc", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-15 10:48", "source": "ThreatFox" }, { "ioc": "debug.sablecroft.cc", "type": "domain", "threat": "botnet_cc", "malware": "ACR Stealer", "confidence": 75, "first_seen": "2026-11-15 10:48", "source": "ThreatFox" }, { "ioc": "zanakillakill.cc", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-15 10:48", "source": "ThreatFox" }, { "ioc": "gomezdown.cc", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-15 10:48", "source": "ThreatFox" }, { "ioc": "majajaklop.cc", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-15 10:48", "source": "ThreatFox" }, { "ioc": "ml.mirthvaleway.cc", "type": "domain", "threat": "botnet_cc", "malware": "ACR Stealer", "confidence": 75, "first_seen": "2026-11-15 10:48", "source": "ThreatFox" }, { "ioc": "http://108.165.95.10/x86_64", "type": "url", "threat": "malware_download", "malware": "elf, ssh", "confidence": 100, "first_seen": "2026-11-15 10:48", "source": "URLhaus" }, { "ioc": "https://sourcemirrors.org/hosted/90628-clone_deltastorm.tar.gz", "type": "url", "threat": "malware_download", "malware": "ssh", "confidence": 100, "first_seen": "2026-11-15 10:48", "source": "URLhaus" }, { "ioc": "https://sourcemirrors.org/hosted/32354-deltastorm.tar.gz", "type": "url", "threat": "malware_download", "malware": "ssh", "confidence": 100, "first_seen": "2026-11-15 10:48", "source": "URLhaus" }, { "ioc": "https://linuxutil5.pages.dev/rootpacket.tar.gz", "type": "url", "threat": "malware_download", "malware": "docker, ssh", "confidence": 100, "first_seen": "2026-11-15 10:48", "source": "URLhaus" }, { "ioc": "http://27.205.158.201:56311/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 10:47", "source": "URLhaus" }, { "ioc": "http://115.50.203.46:52866/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 10:47", "source": "URLhaus" }, { "ioc": "http://191.243.174.35:39481/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 10:47", "source": "URLhaus" }, { "ioc": "http://42.224.24.44:51903/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 10:47", "source": "URLhaus" }, { "ioc": "http://66.205.238.110:47183/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 10:47", "source": "URLhaus" }, { "ioc": "http://61.137.132.140:38460/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 10:45", "source": "URLhaus" }, { "ioc": "http://115.48.146.158:46145/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 10:39", "source": "URLhaus" }, { "ioc": "packmart.lk", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 10:36", "source": "ThreatFox" }, { "ioc": "ytuber.me", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "viajescyp.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "techylondon.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "techlymagazine.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "starmasonsstudio.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "solmaidschoolandcollege.edu.bd", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "snapjournal.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "slotozagls.top", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "firstchoiceinterlocking.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "fraules.shop", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "getcompare.in", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "hellobizmia.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "oci.net.in", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "newslikeyou.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "mubet88.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "movierulzz.co.in", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "mahibloom.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "laurencartercounselling.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "labcenterlab.net.br", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "rednoseza.co.za", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "pulsedrumming.org", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "pspicks.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "gmtimes.de", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "handelburrichter.de", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "efullforms.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "cycsupplies.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "alkemycare.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "amgelevatorsolutions.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "devjyotghoshal.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:35", "source": "ThreatFox" }, { "ioc": "https://wwce.hellowortnm.cn/youdao/yoduao123.zip", "type": "url", "threat": "malware_download", "malware": "SilverFox, ValleyRAT", "confidence": 100, "first_seen": "2026-11-15 10:33", "source": "URLhaus" }, { "ioc": "riosdanville.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "recoverydynamics.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "qualitycleaningnj.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "partnersincredit.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "okrinowatch.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "ok222.online", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "nohu90web.net", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "nameschoose.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "mmcolection.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "min88.fit", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "markandmake.co", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "man88.ink", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "liveatauburnhills.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "li-solutions.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "x88t.space", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "zagrebelskylaw.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "zbet.design", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "zhipeng.me", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "millerhtx.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "waliyabets.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "vt88.world", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "vlferramentas.com.br", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "vk88.work", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "viva88.style", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "vb88t.ink", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "va88.games", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "tx688.net", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "tx68.blog", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "tradingxone.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "tosogha.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "tin88.design", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "tangallesrilanka.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "statewidetreeservice.com.au", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "st666vn.site", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "st66605.pro", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "slotgame191.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "sinbet.jp.net", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "rs88.de", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "rolehunting.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "gamvip.work", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "lawsandlegals.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "khansworkstation.tech", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "kairosintegrativecare.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "k9k9.xyz", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "jj88t.xyz", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "jamalprime.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "infinitewellnessmedspa.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "indiskool.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "humansofev.info", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "howtoexplainer.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "housinggram.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "herbal-health.uk", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "gwinn.xyz", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "grittydigitals.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "greenafia.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "gorainterior.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "gofreedomenergy.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "gasketdoctor.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "freenaukarialert.in", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "fencecontractorraleigh.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "evohumanx.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "dv88t.online", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "dmwasteremovals.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "danaswebsites.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "daga88d.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "da881.games", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "coxsbazarnews24.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "clothes4work.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "choptaplus.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "bong99.world", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "bohampton.net", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "billigelektrikerstockholm.se", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "bh7979.xyz", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "americanprime.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "abh79.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "ab88.pw", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "ab88.online", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "888too.online", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "77ball.one", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "86bet.ink", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "66clubb.online", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "55winn.online", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "3winn.xyz", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "ThreatFox" }, { "ioc": "https://guanfangxiazai-oss-cn-singapore-aliyuncs.top/YouDaoX64.zip", "type": "url", "threat": "malware_download", "malware": "SilverFox, ValleyRAT", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "URLhaus" }, { "ioc": "https://windo.oss-cn-hongkong.aliyuncs.com/Youdao_win.zip", "type": "url", "threat": "malware_download", "malware": "SilverFox, ValleyRAT", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "URLhaus" }, { "ioc": "https://pub-423927d9b82649c681bc5899c6177996.r2.dev/11.15ydfywondisans9.zip", "type": "url", "threat": "malware_download", "malware": "SilverFox, ValleyRAT", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "URLhaus" }, { "ioc": "http://115.50.203.46:52866/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "URLhaus" }, { "ioc": "http://42.232.229.247:37192/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "URLhaus" }, { "ioc": "http://37.52.138.175:42144/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 10:32", "source": "URLhaus" }, { "ioc": "45.251.240.174:5985", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-15 10:30", "source": "ThreatFox" }, { "ioc": "http://210.245.164.75:17266/D23593D7.Png", "type": "url", "threat": "malware_download", "malware": "elf, iot, PurpleFox", "confidence": 100, "first_seen": "2026-11-15 10:27", "source": "URLhaus" }, { "ioc": "http://210.245.164.75:17266/57BC9B7E.Png", "type": "url", "threat": "malware_download", "malware": "elf, iot", "confidence": 100, "first_seen": "2026-11-15 10:27", "source": "URLhaus" }, { "ioc": "http://210.245.164.75:17266/5B16AF14.Png", "type": "url", "threat": "malware_download", "malware": "elf, iot", "confidence": 100, "first_seen": "2026-11-15 10:27", "source": "URLhaus" }, { "ioc": "http://115.50.93.129:33005/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips", "confidence": 100, "first_seen": "2026-11-15 10:27", "source": "URLhaus" }, { "ioc": "http://113.75.14.20:48504/Mozi.m", "type": "url", "threat": "malware_download", "malware": "elf, iot, Mozi", "confidence": 100, "first_seen": "2026-11-15 10:27", "source": "URLhaus" }, { "ioc": "https://d1k4ozb5t9l7ci.cloudfront.net/app/TroveX-release-1.4.apk", "type": "url", "threat": "malware_download", "malware": "apk , crypto, fakeapp", "confidence": 100, "first_seen": "2026-11-15 10:27", "source": "URLhaus" }, { "ioc": "http://45.94.47.126/455", "type": "url", "threat": "malware_download", "malware": "powershell, trojan", "confidence": 100, "first_seen": "2026-11-15 10:27", "source": "URLhaus" }, { "ioc": "meta3.grovestack.one", "type": "domain", "threat": "botnet_cc", "malware": "RevStealer", "confidence": 100, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "stat9.wintergroup.one", "type": "domain", "threat": "botnet_cc", "malware": "RevStealer", "confidence": 100, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "0ded8309977b002cb426d6e1445125a53d4c82038168c2de8f37233d6816a156", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 90, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "node.tutor-lens77.xyz", "type": "domain", "threat": "botnet_cc", "malware": "RevStealer", "confidence": 100, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "init1.wavefleet63.work", "type": "domain", "threat": "botnet_cc", "malware": "RevStealer", "confidence": 100, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "32ed319b08ee64d4bf6b71de79738f3c799db9f0087bc9d20bfb9f5c57ce5dd7", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 90, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "87ab8e5de47652d88f7ed1788b775e03b438482fa14cc19bce9cecdc567d4d48", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 90, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "swarnbhoomitimes.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "413448876264d36960375c969e0e2ed433736ac3def2956387487dccae58334c", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 90, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "a7eb8e3159d6bb0894c507c922c53d3a5726a9fe60c9768214b9e5c6794841bd", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 90, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "starelementrestoration.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "supervisedvisitationoklahoma.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "pgknieruchomosci.pl", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "leadingagency.co", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "myslotgame.top", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "onmservices.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "ww25.trybuilder.website", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "mastermindescapekc.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "insurmedia.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "idp24news.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "khulnaseba.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "hldesigners.pt", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "www.womenscollegekolkata.in", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 10:26", "source": "ThreatFox" }, { "ioc": "https://kernelscv.cfd/assets/2.zip", "type": "url", "threat": "malware_download", "malware": "1352, ClickFix, Password-protected, zip", "confidence": 100, "first_seen": "2026-11-15 10:26", "source": "URLhaus" }, { "ioc": "https://raster15.com/f/qus5n9iecneukfdd5bqagg/8d5wkyb6", "type": "url", "threat": "malware_download", "malware": "ClickFix, Foxveil, Loader, macho, macOS, ua-curl", "confidence": 100, "first_seen": "2026-11-15 10:26", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/shannylate/Fluxus-Roblox-Executor/refs/heads/main/Fluxus%20V7.exe", "type": "url", "threat": "malware_download", "malware": "github", "confidence": 100, "first_seen": "2026-11-15 10:26", "source": "URLhaus" }, { "ioc": "https://kernelscv.cfd/?t=office", "type": "url", "threat": "malware_download", "malware": "ClickFix, powershell, ua-ps", "confidence": 100, "first_seen": "2026-11-15 10:26", "source": "URLhaus" }, { "ioc": "http://105.225.127.47:50801/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 10:17", "source": "URLhaus" }, { "ioc": "http://42.224.24.44:51903/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 10:17", "source": "URLhaus" }, { "ioc": "http://61.137.141.170:57134/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 10:13", "source": "URLhaus" }, { "ioc": "bi.aradi777.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 10:05", "source": "ThreatFox" }, { "ioc": "218.237.58.53:8084", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-15 10:05", "source": "ThreatFox" }, { "ioc": "120.79.172.40:7000", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-15 10:05", "source": "ThreatFox" }, { "ioc": "192.162.199.218:222", "type": "ip:port", "threat": "botnet_cc", "malware": "Quasar RAT", "confidence": 100, "first_seen": "2026-11-15 10:05", "source": "ThreatFox" }, { "ioc": "176.44.68.157:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Havoc", "confidence": 100, "first_seen": "2026-11-15 10:05", "source": "ThreatFox" }, { "ioc": "http://120.84.213.61:54297/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 10:02", "source": "URLhaus" }, { "ioc": "http://60.18.59.73:35403/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 10:02", "source": "URLhaus" }, { "ioc": "http://79.106.231.174:59296/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 10:02", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/leno22/raddebugger/refs/heads/main/Assets/_Recovery/sim-racing-manager-wheel-open-engine-1.1.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-15 09:57", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/leno22/raddebugger/refs/heads/main/Assets/UI/Scripts-Games/USS/manager-open-racing-sim-engine-wheel-v3.4.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-15 09:57", "source": "URLhaus" }, { "ioc": "91.200.220.179:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-15 09:48", "source": "ThreatFox" }, { "ioc": "149.33.32.158:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-15 09:48", "source": "ThreatFox" }, { "ioc": "http://42.58.230.215:60392/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 09:47", "source": "URLhaus" }, { "ioc": "http://105.184.65.64:39945/i", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 09:39", "source": "URLhaus" }, { "ioc": "http://60.18.59.73:35403/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 09:32", "source": "URLhaus" }, { "ioc": "http://221.15.198.66:58014/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 09:32", "source": "URLhaus" }, { "ioc": "http://115.63.54.4:37152/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 09:32", "source": "URLhaus" }, { "ioc": "http://125.41.244.143:47349/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-15 09:19", "source": "ThreatFox" }, { "ioc": "http://59.103.110.60:45103/Mozi.a", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-15 09:19", "source": "ThreatFox" }, { "ioc": "http://182.34.60.169:48147/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-15 09:19", "source": "ThreatFox" }, { "ioc": "http://119.73.7.19:58797/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-15 09:19", "source": "ThreatFox" }, { "ioc": "http://180.243.6.63:34863/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-15 09:19", "source": "ThreatFox" }, { "ioc": "http://175.107.233.197:53063/Mozi.a", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-15 09:19", "source": "ThreatFox" }, { "ioc": "http://115.55.194.102:53950/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 09:17", "source": "URLhaus" }, { "ioc": "http://115.58.88.213:34011/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 09:16", "source": "URLhaus" }, { "ioc": "http://123.14.85.49:60359/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 09:11", "source": "URLhaus" }, { "ioc": "t4.aradi777.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 09:10", "source": "ThreatFox" }, { "ioc": "http://101.108.74.145:49627/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 09:02", "source": "URLhaus" }, { "ioc": "http://115.63.54.4:37152/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 09:02", "source": "URLhaus" }, { "ioc": "http://27.44.147.26:49761/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 09:02", "source": "URLhaus" }, { "ioc": "https://buysellpoultry.com/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-15 09:00", "source": "ThreatFox" }, { "ioc": "https://gmotixprime.com/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-15 09:00", "source": "ThreatFox" }, { "ioc": "https://888to.fit/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-15 09:00", "source": "ThreatFox" }, { "ioc": "https://777locc.online/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-15 09:00", "source": "ThreatFox" }, { "ioc": "https://flags.vkt.sh/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-15 09:00", "source": "ThreatFox" }, { "ioc": "https://www.devjyotghoshal.com/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-15 09:00", "source": "ThreatFox" }, { "ioc": "6ca187b9eaf08c9ee99d9afdb7948cbbc9472beabbc6ea38edee672d4b514f0b", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 08:58", "source": "ThreatFox" }, { "ioc": "1f5f112c5b6356766bc8222b5481409ccf135a73a8bbdd494e781a4de4872e66", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 08:58", "source": "ThreatFox" }, { "ioc": "https://raw.githubusercontent.com/kailas-design/spectromood/refs/heads/main/src/realsense_vision_kit_peritreme.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-15 08:55", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/kailas-design/spectromood/refs/heads/main/siper/realsense-vision-kit.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-15 08:55", "source": "URLhaus" }, { "ioc": "alert.bakerypark51.wiki", "type": "domain", "threat": "botnet_cc", "malware": "RevStealer", "confidence": 75, "first_seen": "2026-11-15 08:52", "source": "ThreatFox" }, { "ioc": "http://201.159.91.2:40711/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-15 08:51", "source": "URLhaus" }, { "ioc": "hz0pdzsw.zayce.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-15 08:49", "source": "ThreatFox" }, { "ioc": "http://123.14.182.170:58536/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 08:47", "source": "URLhaus" }, { "ioc": "http://60.19.6.86:50865/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 08:47", "source": "URLhaus" }, { "ioc": "tasma.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-15 08:45", "source": "ThreatFox" }, { "ioc": "http://119.99.249.182:48833/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 08:32", "source": "URLhaus" }, { "ioc": "http://219.154.172.35:54657/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 08:32", "source": "URLhaus" }, { "ioc": "http://219.154.172.35:54657/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 08:32", "source": "URLhaus" }, { "ioc": "www.lilymercyspheretoursandsafaris.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 08:31", "source": "ThreatFox" }, { "ioc": "www.multiwijaya75.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 08:31", "source": "ThreatFox" }, { "ioc": "www.metiers-vins-spiritueux.fr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 08:31", "source": "ThreatFox" }, { "ioc": "www.mahibloom.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 08:31", "source": "ThreatFox" }, { "ioc": "maximainmobiliaria.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 08:31", "source": "ThreatFox" }, { "ioc": "raster15.com", "type": "domain", "threat": "payload_delivery", "malware": "AMOS", "confidence": 100, "first_seen": "2026-11-15 08:26", "source": "ThreatFox" }, { "ioc": "e0e1173799031873f9a31b83faa20d6064ba79d7b4b11fbce84d443d80f0aa02", "type": "sha256_hash", "threat": "payload", "malware": "AMOS", "confidence": 100, "first_seen": "2026-11-15 08:26", "source": "ThreatFox" }, { "ioc": "12c46c2737251fdc5cb576fc228a981a47e2b0143577bd7f35da22f94011cddb", "type": "sha256_hash", "threat": "payload", "malware": "AMOS", "confidence": 100, "first_seen": "2026-11-15 08:26", "source": "ThreatFox" }, { "ioc": "https://raster15.com/curl/6edvan6qlx1/o0r1mvm569f8tnc1v82.json", "type": "url", "threat": "payload_delivery", "malware": "AMOS", "confidence": 100, "first_seen": "2026-11-15 08:26", "source": "ThreatFox" }, { "ioc": "mindscaping.pro", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 08:21", "source": "ThreatFox" }, { "ioc": "www.retrieverarbeit.ch", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 08:21", "source": "ThreatFox" }, { "ioc": "metalicsaleix.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 08:21", "source": "ThreatFox" }, { "ioc": "http://123.190.196.203:56289/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 08:17", "source": "URLhaus" }, { "ioc": "http://182.117.79.186:34504/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 08:17", "source": "URLhaus" }, { "ioc": "http://105.184.174.68:52319/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 08:17", "source": "URLhaus" }, { "ioc": "http://42.230.42.133:40248/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 08:15", "source": "URLhaus" }, { "ioc": "lersadvocacia.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 08:11", "source": "ThreatFox" }, { "ioc": "l.gg018.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 08:10", "source": "ThreatFox" }, { "ioc": "bs.aradi777.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 08:05", "source": "ThreatFox" }, { "ioc": "apibet99.net", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 08:05", "source": "ThreatFox" }, { "ioc": "thr.apibet99.net", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 08:05", "source": "ThreatFox" }, { "ioc": "http://39.90.186.130:46174/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 08:02", "source": "URLhaus" }, { "ioc": "http://61.52.157.198:52440/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 08:02", "source": "URLhaus" }, { "ioc": "http://42.55.96.70:53108/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 08:02", "source": "URLhaus" }, { "ioc": "novagameit.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 08:01", "source": "ThreatFox" }, { "ioc": "manpowercomplianceservices.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 08:01", "source": "ThreatFox" }, { "ioc": "http://120.76.202.245:8070/linux", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 08:01", "source": "URLhaus" }, { "ioc": "7bf54debf86747cb7c55c5472a6d19a32a77fc434b8e083826f38aea09a26408", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 07:58", "source": "ThreatFox" }, { "ioc": "767be11654618c73c39cc26b9d285ed57b349292b41aac264491aeb047eba277", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 07:58", "source": "ThreatFox" }, { "ioc": "http://36.77.226.233:60190/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-15 07:55", "source": "URLhaus" }, { "ioc": "http://61.52.169.123:36974/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 07:49", "source": "URLhaus" }, { "ioc": "https://cdn.discordapp.com/attachments/1250346745955880971/1571475528014241944/c46387a43d?ex=6afade22&is=6af98ca2&hm=8a20faa23d81885766be4eadeab493d595648ae4fb5a10afdf65a4f1d40809e8&", "type": "url", "threat": "malware_download", "malware": "IRAHook", "confidence": 100, "first_seen": "2026-11-15 07:48", "source": "URLhaus" }, { "ioc": "http://105.225.189.236:58503/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 07:47", "source": "URLhaus" }, { "ioc": "http://120.28.166.185:40785/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 07:47", "source": "URLhaus" }, { "ioc": "http://125.41.227.230:52034/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 07:32", "source": "URLhaus" }, { "ioc": "http://39.88.162.57:52629/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 07:32", "source": "URLhaus" }, { "ioc": "www.hojarasca.net", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 07:25", "source": "ThreatFox" }, { "ioc": "kardeslerevdenevenakliyat.xyz", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 07:25", "source": "ThreatFox" }, { "ioc": "homefarmrepairs.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 07:25", "source": "ThreatFox" }, { "ioc": "www.kahamahotel.co.ke", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 07:25", "source": "ThreatFox" }, { "ioc": "www.ipermedia.cloud", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 07:25", "source": "ThreatFox" }, { "ioc": "old.ingenieriaysolucionesecr.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 07:25", "source": "ThreatFox" }, { "ioc": "iiss-mru.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 07:25", "source": "ThreatFox" }, { "ioc": "www.johnsessentialservices.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 07:25", "source": "ThreatFox" }, { "ioc": "http://61.52.169.123:36974/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 07:18", "source": "URLhaus" }, { "ioc": "http://125.41.227.230:52034/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 07:17", "source": "URLhaus" }, { "ioc": "http://115.55.194.102:53950/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 07:17", "source": "URLhaus" }, { "ioc": "joingames.net", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 07:15", "source": "ThreatFox" }, { "ioc": "humildadysilencio.org", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 07:15", "source": "ThreatFox" }, { "ioc": "http://105.225.6.113:42321/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-15 07:12", "source": "URLhaus" }, { "ioc": "http://123.5.190.102:49084/i", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 07:10", "source": "URLhaus" }, { "ioc": "http://221.0.102.207:57581/i", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 07:10", "source": "URLhaus" }, { "ioc": "http://105.225.6.113:42321/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-15 07:08", "source": "URLhaus" }, { "ioc": "kimnaturalfoods.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 07:05", "source": "ThreatFox" }, { "ioc": "jungstudios.co", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 07:05", "source": "ThreatFox" }, { "ioc": "d3.aradi777.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 07:05", "source": "ThreatFox" }, { "ioc": "89.116.210.28:8080", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-15 07:05", "source": "ThreatFox" }, { "ioc": "http://124.131.143.152:57512/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 07:02", "source": "URLhaus" }, { "ioc": "http://110.83.152.175:46990/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 07:02", "source": "URLhaus" }, { "ioc": "http://42.55.96.70:53108/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 07:02", "source": "URLhaus" }, { "ioc": "7771cb6db5631b9b1a68d2e97ab6002f25d88e97a42cb2d82b1e508b8dff6091", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 90, "first_seen": "2026-11-15 06:58", "source": "ThreatFox" }, { "ioc": "holtnow.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 06:55", "source": "ThreatFox" }, { "ioc": "https://raw.githubusercontent.com/harrypapaai/auto-team-custom/refs/heads/public/idls/Software-3.1.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-15 06:52", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/harrypapaai/auto-team-custom/refs/heads/public/utils/src/Software-v3.0.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-15 06:52", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/harrypapaai/auto-team-custom/refs/heads/public/tests/tutils/fixtures/Software-v2.9.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-15 06:52", "source": "URLhaus" }, { "ioc": "https://cdn.discordapp.com/attachments/1347298195562037321/1571460999683244092/a0f88ffb47?ex=6afad09a&is=6af97f1a&hm=f28d35d770bd406b6ba2e59ad979ed8183094660906c08a353bae0900e4da3b6&", "type": "url", "threat": "malware_download", "malware": "IRAHook", "confidence": 100, "first_seen": "2026-11-15 06:49", "source": "URLhaus" }, { "ioc": "http://210.208.110.147:40954/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 06:47", "source": "URLhaus" }, { "ioc": "retrieverarbeit.ch", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 06:45", "source": "ThreatFox" }, { "ioc": "153.75.250.83:8443", "type": "ip:port", "threat": "botnet_cc", "malware": "Evilginx", "confidence": 75, "first_seen": "2026-11-15 06:43", "source": "ThreatFox" }, { "ioc": "103.155.92.49:4321", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 75, "first_seen": "2026-11-15 06:43", "source": "ThreatFox" }, { "ioc": "http://112.248.111.128:57247/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 06:37", "source": "URLhaus" }, { "ioc": "http://115.151.143.25:49643/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 06:32", "source": "URLhaus" }, { "ioc": "fahr-sulz.ch", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 06:25", "source": "ThreatFox" }, { "ioc": "http://125.24.10.85:39984/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-15 06:18", "source": "URLhaus" }, { "ioc": "aradi777.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 06:10", "source": "ThreatFox" }, { "ioc": "o2.aradi777.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 06:10", "source": "ThreatFox" }, { "ioc": "89.116.210.28:80", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-15 06:05", "source": "ThreatFox" }, { "ioc": "89.116.210.28:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-15 06:05", "source": "ThreatFox" }, { "ioc": "89.116.210.28:22", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-15 06:05", "source": "ThreatFox" }, { "ioc": "85.189.45.191:43211", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 100, "first_seen": "2026-11-15 06:05", "source": "ThreatFox" }, { "ioc": "85.189.45.191:22", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 100, "first_seen": "2026-11-15 06:05", "source": "ThreatFox" }, { "ioc": "http://175.162.249.76:43771/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 06:02", "source": "URLhaus" }, { "ioc": "8fc330e6a6d3ae9af8fa3e81b380a2f64a24703e30e53937798363753225f337", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 05:58", "source": "ThreatFox" }, { "ioc": "http://125.24.10.85:39984/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-15 05:56", "source": "URLhaus" }, { "ioc": "https://github.com/OpenAdvocate25/sppvcizm/releases/download/2/MR.exe", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer", "confidence": 100, "first_seen": "2026-11-15 05:50", "source": "URLhaus" }, { "ioc": "http://210.208.106.68:44895/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-15 05:38", "source": "URLhaus" }, { "ioc": "http://210.208.106.68:44895/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-15 05:38", "source": "URLhaus" }, { "ioc": "http://42.232.236.182:56224/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 05:36", "source": "URLhaus" }, { "ioc": "static.wanderreef37.wiki", "type": "domain", "threat": "botnet_cc", "malware": "RevStealer", "confidence": 75, "first_seen": "2026-11-15 05:32", "source": "ThreatFox" }, { "ioc": "http://112.248.111.128:57247/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 05:32", "source": "URLhaus" }, { "ioc": "http://175.162.249.76:43771/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 05:32", "source": "URLhaus" }, { "ioc": "http://61.53.102.45:33734/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 05:32", "source": "URLhaus" }, { "ioc": "http://5.26.195.93:59726/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 05:32", "source": "URLhaus" }, { "ioc": "osira.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-15 05:25", "source": "ThreatFox" }, { "ioc": "http://183.35.50.78:38590/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 05:17", "source": "URLhaus" }, { "ioc": "www.gsrunners.it", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 05:10", "source": "ThreatFox" }, { "ioc": "http://42.232.236.182:56224/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 05:09", "source": "URLhaus" }, { "ioc": "https://imperia243.com/Faithful.zip", "type": "url", "threat": "malware_download", "malware": "ClickFix, hta, minecraft, mshta", "confidence": 100, "first_seen": "2026-11-15 05:09", "source": "URLhaus" }, { "ioc": "dux.aprendizajeeslibertad.cl", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 05:05", "source": "ThreatFox" }, { "ioc": "k.gg018.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 05:05", "source": "ThreatFox" }, { "ioc": "http://5.26.195.93:59726/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 05:02", "source": "URLhaus" }, { "ioc": "http://123.4.192.68:44696/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 05:02", "source": "URLhaus" }, { "ioc": "www.go2fuzzy.de", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 05:00", "source": "ThreatFox" }, { "ioc": "98003f5a2840c3cf38953031f712e69e3f983e079f459d4caddd91e9b317b2df", "type": "sha256_hash", "threat": "payload", "malware": "Cobalt Strike", "confidence": 90, "first_seen": "2026-11-15 04:59", "source": "ThreatFox" }, { "ioc": "6c6a06dd6e01fd09e9fc3a9c1fbd58c4f5e7b1e69e126f9640bbf5dad621a6fd", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:59", "source": "ThreatFox" }, { "ioc": "83ff6b2eca72cf431fb299b1bd3c9f24830d614880736d696300db4e216aa019", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:59", "source": "ThreatFox" }, { "ioc": "00833f547b1ba8b374651a856a4e8b2bb9dc8662087d7f82c4e0913505268a67", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:59", "source": "ThreatFox" }, { "ioc": "8ca974f73592e2115c2a34c92f77e932a06d02bd4f61629f756c25b26d37fc1b", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:59", "source": "ThreatFox" }, { "ioc": "4ed694ecaaf04378316222f4f8e0ec73a2cfdef0fbabd4a73b4ac7ae4aeee3a8", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:59", "source": "ThreatFox" }, { "ioc": "86d249ebaba9b5a961f86d282d4da93dc3ac29a21e561335551cfe54c87a4e11", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:59", "source": "ThreatFox" }, { "ioc": "b90996cd3c1f7d8bbfe687750ed00eb0fbfebf0892cf7b688cec02d37fa873bc", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:59", "source": "ThreatFox" }, { "ioc": "56df524c4b5bf47d0268806d808b5661958e07b012dc434575cf30c57cadb30e", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:59", "source": "ThreatFox" }, { "ioc": "11d005872af286fa8b17af6ecd1cf9278e9954791c21ea600f96af965588ce73", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:59", "source": "ThreatFox" }, { "ioc": "33c2770d94efe54f5da426366fac365bf92b8cb41f930180292013919200c4ed", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:58", "source": "ThreatFox" }, { "ioc": "90dac344e475ea58697bfd845a95a83fdb5f8ce601d6e8d388a9b325cd1e69b0", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:58", "source": "ThreatFox" }, { "ioc": "a4f253c0fcc17d7862e62ee9dfb57ca992019373897f2034dce19b13b83746be", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:58", "source": "ThreatFox" }, { "ioc": "b9fef4ffea941f7075707b0854d3e93646209e53ada618e1847cacbefec626eb", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:58", "source": "ThreatFox" }, { "ioc": "e46353a89c08607d9d73dfbcf15609a84ee94e7ae7b4a19f50a5b9eeea95e680", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:58", "source": "ThreatFox" }, { "ioc": "a53f7e8c10a8fc576fae932eebe19c3daa110a6db7edc3ed5e80423632f49b7f", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:58", "source": "ThreatFox" }, { "ioc": "357300de022028f465c155d1fec0e14dd1f2234f1f06448d8070ebcc3066e926", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:58", "source": "ThreatFox" }, { "ioc": "6f7020a54322e86489c03615574ba659dc99e326928e796095193d7d21d21a06", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 04:58", "source": "ThreatFox" }, { "ioc": "http://193.178.158.57/uploads/5b74c6b78e46fa9d_136.php", "type": "url", "threat": "malware_download", "malware": "encrypted", "confidence": 100, "first_seen": "2026-11-15 04:53", "source": "URLhaus" }, { "ioc": "http://193.178.158.57/login.php", "type": "url", "threat": "botnet_cc", "malware": "SolarisLoader", "confidence": 100, "first_seen": "2026-11-15 04:52", "source": "ThreatFox" }, { "ioc": "http://193.178.158.107/login.php", "type": "url", "threat": "botnet_cc", "malware": "SolarisLoader", "confidence": 100, "first_seen": "2026-11-15 04:52", "source": "ThreatFox" }, { "ioc": "http://196.251.107.186/login.php", "type": "url", "threat": "botnet_cc", "malware": "SolarisLoader", "confidence": 100, "first_seen": "2026-11-15 04:52", "source": "ThreatFox" }, { "ioc": "http://193.178.158.107/Nsdjb4T/index.php", "type": "url", "threat": "botnet_cc", "malware": "Amadey", "confidence": 100, "first_seen": "2026-11-15 04:50", "source": "ThreatFox" }, { "ioc": "www.emagetranscripts.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 04:50", "source": "ThreatFox" }, { "ioc": "www.falgo.se", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 04:50", "source": "ThreatFox" }, { "ioc": "www.finestore.lk", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 04:50", "source": "ThreatFox" }, { "ioc": "http://193.178.158.57/8fdjjfdSD/index.php", "type": "url", "threat": "botnet_cc", "malware": "Amadey", "confidence": 100, "first_seen": "2026-11-15 04:50", "source": "ThreatFox" }, { "ioc": "http://61.52.82.39:49626/i", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 04:50", "source": "URLhaus" }, { "ioc": "https://github.com/pointdesigneraura/ifhqnuqv/releases/download/jndfv/Software.zip", "type": "url", "threat": "malware_download", "malware": "2026, github, Password-protected, zip", "confidence": 100, "first_seen": "2026-11-15 04:48", "source": "URLhaus" }, { "ioc": "mhgroup.com.pk", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 04:40", "source": "ThreatFox" }, { "ioc": "gracetv.co", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 04:40", "source": "ThreatFox" }, { "ioc": "http://210.208.110.20:51483/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:32", "source": "URLhaus" }, { "ioc": "http://105.225.127.47:50801/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:32", "source": "URLhaus" }, { "ioc": "http://210.208.110.20:51483/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:32", "source": "URLhaus" }, { "ioc": "http://125.43.107.215:59283/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:32", "source": "URLhaus" }, { "ioc": "http://182.113.4.176:33195/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 04:31", "source": "URLhaus" }, { "ioc": "littlefishmom.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 04:30", "source": "ThreatFox" }, { "ioc": "www.fideca.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 04:30", "source": "ThreatFox" }, { "ioc": "www.fumivet.cl", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 04:30", "source": "ThreatFox" }, { "ioc": "https://fsdownload.s3.eu-west-3.amazonaws.com/EXNACE.apk", "type": "url", "threat": "malware_download", "malware": "apk , crypto, fakeapp", "confidence": 100, "first_seen": "2026-11-15 04:24", "source": "URLhaus" }, { "ioc": "https://spaceware.to/Spaceware_updated.zip", "type": "url", "threat": "malware_download", "malware": "Password-protected, spaceware, zip", "confidence": 100, "first_seen": "2026-11-15 04:24", "source": "URLhaus" }, { "ioc": "http://191.217.250.87/hiddenbin2/mips", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-15 04:23", "source": "ThreatFox" }, { "ioc": "http://105.154.234.74:45332/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 04:21", "source": "URLhaus" }, { "ioc": "1n060nam.zalfa.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-15 04:19", "source": "ThreatFox" }, { "ioc": "http://183.34.182.118:37895/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:17", "source": "URLhaus" }, { "ioc": "http://39.81.216.198:53210/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:17", "source": "URLhaus" }, { "ioc": "http://182.127.122.215:47285/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:17", "source": "URLhaus" }, { "ioc": "http://105.184.65.64:39945/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:17", "source": "URLhaus" }, { "ioc": "http://196.191.104.3:36592/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:17", "source": "URLhaus" }, { "ioc": "seedless-tangem.com", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-15 04:11", "source": "ThreatFox" }, { "ioc": "approval-tangem.com", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-15 04:11", "source": "ThreatFox" }, { "ioc": "approve-tangem.com", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-15 04:11", "source": "ThreatFox" }, { "ioc": "authorize-tangem.com", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-15 04:11", "source": "ThreatFox" }, { "ioc": "backup-tangem.com", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-15 04:11", "source": "ThreatFox" }, { "ioc": "drovlix.com", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-15 04:11", "source": "ThreatFox" }, { "ioc": "fildova.com", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-15 04:11", "source": "ThreatFox" }, { "ioc": "nexdova.com", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-15 04:11", "source": "ThreatFox" }, { "ioc": "seed-tangem.com", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-15 04:11", "source": "ThreatFox" }, { "ioc": "verifying-tangem.com", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-15 04:11", "source": "ThreatFox" }, { "ioc": "verification-tangem.com", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-15 04:11", "source": "ThreatFox" }, { "ioc": "session-tangem.com", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-15 04:11", "source": "ThreatFox" }, { "ioc": "futureleadersincubator.org", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 04:10", "source": "ThreatFox" }, { "ioc": "www.essaywriter.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 04:10", "source": "ThreatFox" }, { "ioc": "www.disanarquitectos.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 04:10", "source": "ThreatFox" }, { "ioc": "http://182.113.4.176:33195/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 04:07", "source": "URLhaus" }, { "ioc": "fot.aprendizajeeslibertad.cl", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 04:05", "source": "ThreatFox" }, { "ioc": "v9.apaljitu.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 04:05", "source": "ThreatFox" }, { "ioc": "45.192.213.147:8084", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 100, "first_seen": "2026-11-15 04:05", "source": "ThreatFox" }, { "ioc": "120.79.172.40:8089", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-15 04:05", "source": "ThreatFox" }, { "ioc": "120.79.172.40:3232", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-15 04:05", "source": "ThreatFox" }, { "ioc": "http://61.52.82.39:49626/bin.sh", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 04:03", "source": "URLhaus" }, { "ioc": "http://138.204.196.244:58129/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:02", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/Heyiwei-i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/ppc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/mipsle", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/arm5", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/arm64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/armv8l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/ppc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/Heyiwei-i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/Heyiwei-mips64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/x86", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/arm7", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/Heyiwei-powerpc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/mipsle", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/Heyiwei-armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/armv7", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/Heyiwei-armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/ppc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/armv7", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/amd64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/Heyiwei-armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/Heyiwei-aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/i386", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/Heyiwei-powerpc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/Heyiwei-i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/Heyiwei-mips64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/Heyiwei-armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/Heyiwei-aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/Heyiwei-i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/Heyiwei-i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/powerpc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/Heyiwei-armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/Heyiwei-x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/Heyiwei-armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/Heyiwei-mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/Heyiwei-armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/Heyiwei-mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/Heyiwei-mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/armv8l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/amd64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/Heyiwei-mips64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/Heyiwei-armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 04:00", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/Heyiwei-powerpc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/dlr.ppc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/dlr.x86", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8100/Heyiwei-i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/spc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/Heyiwei-i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/Heyiwei-mips64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/mipsle", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/arm64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/Heyiwei-x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/mips64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/x86", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8100/Heyiwei-mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/ppc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/Heyiwei-mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/Heyiwei-mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/Heyiwei-i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/armv4", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8100/Heyiwei-x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/x86", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/Heyiwei-mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/amd64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/armv6", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/mipsle", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/armv8l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/Heyiwei-mips64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/arm64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/ppc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/dlr.arm", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/dlr.mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/Heyiwei-mips64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/armv8l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/Heyiwei-i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/mips64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/Heyiwei-armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/ppc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/x86", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/arm64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/armv5", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/mips64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/armv8l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/Heyiwei-armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8100/Heyiwei-armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/powerpc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8100/Heyiwei-i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/Heyiwei-mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/armv6", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/mipsle", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/arm", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/arm", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/powerpc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/Heyiwei-armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8100/Heyiwei-mips64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8100/Heyiwei-armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/Heyiwei-armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/Heyiwei-powerpc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/armv5", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/Heyiwei-mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/x86_32", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/x86_32", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/x86", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/Heyiwei-armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/Heyiwei-mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8100/Heyiwei-aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/Heyiwei-armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/armv8l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/Heyiwei-powerpc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/dlr.x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/Heyiwei-armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/Heyiwei-i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/armv7", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/mips64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/Heyiwei-x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/arm64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/armv6", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/Heyiwei-armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/i386", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/x86_32", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8100/Heyiwei-powerpc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/Heyiwei-armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/Heyiwei-i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/amd64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/Heyiwei-i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/ppc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/arm", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/armv4", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/Heyiwei-aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/Heyiwei-armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/Heyiwei-powerpc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/armv4", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/x86_32", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/armv8l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/Heyiwei-i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/arm", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/armv6", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/Heyiwei-i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/armv6", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/Heyiwei-armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/armv6", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/powerpc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/armv5", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/Heyiwei-mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/arm64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/armv7", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/Heyiwei-x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/Heyiwei-i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/Heyiwei-mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/armv5", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/arm", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/i386", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/Heyiwei-armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/ppc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/arm64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/Heyiwei-aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/mips64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/mips64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/Heyiwei-mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/dlr.arm64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/mpsl", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/Heyiwei-i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/Heyiwei-armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/dlr.spc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/Heyiwei-i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/Heyiwei-mips64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/amd64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/Heyiwei-armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/arm", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/Heyiwei-armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/Heyiwei-armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/armv8l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/mips64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/Heyiwei-armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/dlr.mpsl", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/dlr.arm5", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/Heyiwei-armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/armv4", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/armv7", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/Heyiwei-i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/Heyiwei-armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/Heyiwei-armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/i386", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/Heyiwei-x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/i386", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/Heyiwei-aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/powerpc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/Heyiwei-i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/arm6", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/x86_32", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/Heyiwei-mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/armv7", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/Heyiwei-mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8100/Heyiwei-mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/Heyiwei-armv7l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/Heyiwei-i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/x86", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/Heyiwei-x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/Heyiwei-x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/Heyiwei-i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/Heyiwei-i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/Heyiwei-i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/armv5", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/Heyiwei-armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/Heyiwei-mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/Heyiwei-i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/Heyiwei-powerpc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/armv6", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/armv7", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8100/Heyiwei-armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/i386", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/i386", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/x86_32", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8100/Heyiwei-armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/armv4", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/mips64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/Heyiwei-armv6l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/armv4", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/Heyiwei-aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/i686", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/amd64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/Heyiwei-x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/powerpc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/i386", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/Heyiwei-i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/arm", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/armv5", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/Heyiwei-powerpc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/armv4", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/armv6", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/armv4l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://38.39.30.232:33196/x86", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/armv5", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/powerpc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8087/mipsle", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/x86_64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/Heyiwei-armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/arm", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/ppc", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/x86_32", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/armv5", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/Heyiwei-aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/i586", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/mipsle", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/x86", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/x86_32", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/Heyiwei-mips", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/armv7", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8098/armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8095/arm64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/x86", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157/amd64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/Heyiwei-aarch64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8099/armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/arm64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8100/Heyiwei-i486", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8096/mipsel", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/amd64", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8094/armv4", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/arm", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://204.141.236.157:8097/armv5l", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:59", "source": "URLhaus" }, { "ioc": "http://64.204.80.235:8444/uzum_beacon", "type": "url", "threat": "malware_download", "malware": "hacktool, Sliver", "confidence": 100, "first_seen": "2026-11-15 03:58", "source": "URLhaus" }, { "ioc": "http://64.204.80.235:8444/uzum_mips64", "type": "url", "threat": "malware_download", "malware": "hacktool, Sliver", "confidence": 100, "first_seen": "2026-11-15 03:58", "source": "URLhaus" }, { "ioc": "http://85.202.161.25:9999/msdtc.exe", "type": "url", "threat": "malware_download", "malware": "AdaptixC2, hacktool", "confidence": 100, "first_seen": "2026-11-15 03:58", "source": "URLhaus" }, { "ioc": "http://93.94.52.4/yrjrs/tctc.bba", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:58", "source": "URLhaus" }, { "ioc": "http://154.94.232.212:9999/probe_docker.exe", "type": "url", "threat": "malware_download", "malware": "CobaltStrike, hacktool", "confidence": 100, "first_seen": "2026-11-15 03:58", "source": "URLhaus" }, { "ioc": "http://154.94.232.212:9999/ipf_cs.exe", "type": "url", "threat": "malware_download", "malware": "Cobalt strike, CobaltStrike, hacktool", "confidence": 100, "first_seen": "2026-11-15 03:58", "source": "URLhaus" }, { "ioc": "http://thexfil.fit/exe_3004/rifaien2-W88AxUX3Fv8IKWaN.exe", "type": "url", "threat": "malware_download", "malware": "snojan", "confidence": 100, "first_seen": "2026-11-15 03:58", "source": "URLhaus" }, { "ioc": "http://154.94.232.212:9999/s46_stager.ps1", "type": "url", "threat": "malware_download", "malware": "downloader, Loader, vshell", "confidence": 100, "first_seen": "2026-11-15 03:58", "source": "URLhaus" }, { "ioc": "https://boost-19.com/f/zh2s2xptaamrnzpdyiq0ng/vj1ury4s", "type": "url", "threat": "malware_download", "malware": "ClickFix, Foxveil, Loader, macho, macOS, ua-curl", "confidence": 100, "first_seen": "2026-11-15 03:58", "source": "URLhaus" }, { "ioc": "77.239.124.141:18129", "type": "ip:port", "threat": "botnet_cc", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-15 03:56", "source": "ThreatFox" }, { "ioc": "204.141.236.157:25565", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-15 03:56", "source": "ThreatFox" }, { "ioc": "85.11.167.150:18129", "type": "ip:port", "threat": "botnet_cc", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-15 03:56", "source": "ThreatFox" }, { "ioc": "204.141.236.157:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-15 03:56", "source": "ThreatFox" }, { "ioc": "45.90.163.37:45447", "type": "ip:port", "threat": "botnet_cc", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-15 03:55", "source": "ThreatFox" }, { "ioc": "mc.heyiwei.net", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-15 03:55", "source": "ThreatFox" }, { "ioc": "45.90.163.37:42772", "type": "ip:port", "threat": "botnet_cc", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-15 03:55", "source": "ThreatFox" }, { "ioc": "45.90.163.37:44559", "type": "ip:port", "threat": "botnet_cc", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-15 03:55", "source": "ThreatFox" }, { "ioc": "45.90.163.37:38722", "type": "ip:port", "threat": "botnet_cc", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-15 03:55", "source": "ThreatFox" }, { "ioc": "wearecook.cc.cd", "type": "domain", "threat": "botnet_cc", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-15 03:55", "source": "ThreatFox" }, { "ioc": "1194bd4526a1dd1da28281372ab8a4f541532e9e0e0a083c782116da52c9dab0", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 90, "first_seen": "2026-11-15 03:55", "source": "ThreatFox" }, { "ioc": "goarepaircenter.in", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 03:55", "source": "ThreatFox" }, { "ioc": "flags.vkt.sh", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 03:55", "source": "ThreatFox" }, { "ioc": "gmotixprime.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 03:55", "source": "ThreatFox" }, { "ioc": "projectconnect.viz4good.io", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 03:55", "source": "ThreatFox" }, { "ioc": "www.devjyotghoshal.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 03:55", "source": "ThreatFox" }, { "ioc": "777locc.online", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 03:55", "source": "ThreatFox" }, { "ioc": "888to.fit", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-15 03:55", "source": "ThreatFox" }, { "ioc": "ecosustentaengenharia.com.br", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 03:50", "source": "ThreatFox" }, { "ioc": "http://182.127.122.215:47285/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:47", "source": "URLhaus" }, { "ioc": "http://222.141.41.214:42244/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:47", "source": "URLhaus" }, { "ioc": "http://138.204.196.244:58129/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:47", "source": "URLhaus" }, { "ioc": "http://196.191.104.3:36592/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:47", "source": "URLhaus" }, { "ioc": "dralouise.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 03:40", "source": "ThreatFox" }, { "ioc": "http://211.21.108.140:1450/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:32", "source": "URLhaus" }, { "ioc": "http://105.225.39.117:36011/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:32", "source": "URLhaus" }, { "ioc": "http://182.124.239.161:44831/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 03:31", "source": "URLhaus" }, { "ioc": "bhhcare.ae", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 03:30", "source": "ThreatFox" }, { "ioc": "archtivedesigns.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 03:30", "source": "ThreatFox" }, { "ioc": "cozy-room.ru", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 03:30", "source": "ThreatFox" }, { "ioc": "dublinsolar.com.br", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 03:30", "source": "ThreatFox" }, { "ioc": "cdcleaning.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 03:30", "source": "ThreatFox" }, { "ioc": "http://190.196.253.59:10269/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-15 03:20", "source": "ThreatFox" }, { "ioc": "http://223.123.34.253:35987/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-15 03:20", "source": "ThreatFox" }, { "ioc": "http://201.203.101.30:53627/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-15 03:16", "source": "URLhaus" }, { "ioc": "http://37.202.182.194:17822/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 03:08", "source": "URLhaus" }, { "ioc": "nv.aprendizajeeslibertad.cl", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 03:05", "source": "ThreatFox" }, { "ioc": "http://123.5.126.210:56903/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:02", "source": "URLhaus" }, { "ioc": "http://105.224.48.27:43411/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 03:02", "source": "URLhaus" }, { "ioc": "https://github.com/OpenAdvocate25/sppvcizm/releases/download/2/123Build.exe", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer", "confidence": 100, "first_seen": "2026-11-15 03:01", "source": "URLhaus" }, { "ioc": "fc9bcdb3a442880e585d6fe4ddaec62d62af641f8ac3cceeb6a553985a7d9094", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-15 02:58", "source": "ThreatFox" }, { "ioc": "324bb699183c9f8c04b70059820fb88c17d7c246981b1668be896d69ca52cc79", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-15 02:58", "source": "ThreatFox" }, { "ioc": "http://201.203.101.30:53627/bin.sh", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 02:58", "source": "URLhaus" }, { "ioc": "http://120.28.201.75:46820/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-15 02:57", "source": "URLhaus" }, { "ioc": "http://87.227.77.116:51591/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 02:40", "source": "URLhaus" }, { "ioc": "http://37.202.182.194:17822/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 02:38", "source": "URLhaus" }, { "ioc": "http://125.47.238.94:55440/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 02:32", "source": "URLhaus" }, { "ioc": "http://105.224.48.27:43411/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 02:32", "source": "URLhaus" }, { "ioc": "http://115.61.113.50:54622/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 02:32", "source": "URLhaus" }, { "ioc": "http://120.28.201.75:46820/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-15 02:30", "source": "URLhaus" }, { "ioc": "http://116.140.95.39:34551/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 02:17", "source": "URLhaus" }, { "ioc": "http://182.123.164.66:33584/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 02:17", "source": "URLhaus" }, { "ioc": "w.gg018.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 02:10", "source": "ThreatFox" }, { "ioc": "inn.aprendizajeeslibertad.cl", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 02:05", "source": "ThreatFox" }, { "ioc": "111.229.193.40:55538", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-15 02:05", "source": "ThreatFox" }, { "ioc": "213.232.236.197:8443", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-15 02:05", "source": "ThreatFox" }, { "ioc": "ometv.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-15 02:04", "source": "ThreatFox" }, { "ioc": "https://raw.githubusercontent.com/vicleyva/spotify-tui/refs/heads/master/entities/Software-v1.0-alpha.1.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-15 02:03", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/vicleyva/spotify-tui/refs/heads/master/routes/Software_1.4.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-15 02:03", "source": "URLhaus" }, { "ioc": "http://27.37.226.89:56881/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 02:02", "source": "URLhaus" }, { "ioc": "http://5.134.252.216:55933/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 02:02", "source": "URLhaus" }, { "ioc": "a308244ebd0b1a204161195cd1f05ea20e1b9dc7a546ce3ce840bdb14d7f8f7b", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-15 01:58", "source": "ThreatFox" }, { "ioc": "5a6e352260f4a05c4b78de181435eb53c18e8da9e1b8e8794ff015636f607a8e", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-15 01:58", "source": "ThreatFox" }, { "ioc": "4e2627700d47a6532d6059f3adb20c78ad90cbb25107070345c27ad48e11cd2b", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-15 01:58", "source": "ThreatFox" }, { "ioc": "de5a9031874fadba9f0a86e1f82fd8af5a22befbb70fdcec6f0c19dcc75353c6", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-15 01:58", "source": "ThreatFox" }, { "ioc": "379a0cb2c3cbe44835865b4688078a0ef69181e19998fc2c478b004f4f9bae0d", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-15 01:58", "source": "ThreatFox" }, { "ioc": "43f79d3e51670dc65ebfa102c0ea175ab33f2d6a5ea6a7fb155076fba1418fe1", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-15 01:58", "source": "ThreatFox" }, { "ioc": "43283be995f6c8e0fa1f839f45f3bb51721c7089be298591bdd426a15b4fbe2a", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 90, "first_seen": "2026-11-15 01:58", "source": "ThreatFox" }, { "ioc": "http://115.61.113.50:54622/bin.sh", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-15 01:58", "source": "URLhaus" }, { "ioc": "http://27.216.172.54:50334/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 01:47", "source": "URLhaus" }, { "ioc": "http://115.151.143.25:49643/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 01:32", "source": "URLhaus" }, { "ioc": "https://github.com/OpenAdvocate25/sppvcizm/releases/download/2/angr.exe", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer", "confidence": 100, "first_seen": "2026-11-15 01:22", "source": "URLhaus" }, { "ioc": "http://42.224.193.22:59846/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 01:17", "source": "URLhaus" }, { "ioc": "http://182.113.192.177:51476/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 01:17", "source": "URLhaus" }, { "ioc": "https://github.com/OpenAdvocate25/sppvcizm/releases/download/2/collrat.exe", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer", "confidence": 100, "first_seen": "2026-11-15 01:16", "source": "URLhaus" }, { "ioc": "https://github.com/OpenAdvocate25/sppvcizm/releases/download/2/neverrat.exe", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer", "confidence": 100, "first_seen": "2026-11-15 01:16", "source": "URLhaus" }, { "ioc": "https://github.com/OpenAdvocate25/sppvcizm/releases/download/2/Pianist.exe", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer", "confidence": 100, "first_seen": "2026-11-15 01:16", "source": "URLhaus" }, { "ioc": "czerninstrategies.ch", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 01:14", "source": "ThreatFox" }, { "ioc": "xp.aprendizajeeslibertad.cl", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 01:05", "source": "ThreatFox" }, { "ioc": "www.pkf.co.in", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 01:04", "source": "ThreatFox" }, { "ioc": "www.rohabuilders.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 01:04", "source": "ThreatFox" }, { "ioc": "http://182.113.192.177:51476/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 01:02", "source": "URLhaus" }, { "ioc": "7fc979bae85d1479790fd7b91bafdae44f4ce969f8815d02251a0d9af80137a6", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-15 00:58", "source": "ThreatFox" }, { "ioc": "fcd83f697bef16a2731554e35342384063a9301bef827a7e1c90a380a3497f9f", "type": "sha256_hash", "threat": "payload", "malware": "WARDENStealer", "confidence": 95, "first_seen": "2026-11-15 00:58", "source": "ThreatFox" }, { "ioc": "3a1e7d2aaeb545d10018b4925a321de02d6ee47122de46c11c701b25a4f08d59", "type": "sha256_hash", "threat": "payload", "malware": "Formbook", "confidence": 100, "first_seen": "2026-11-15 00:58", "source": "ThreatFox" }, { "ioc": "9b1933ff196a946f3b43fdf9a4bea548301b8490f4142c3c3064c0c1a44a7946", "type": "sha256_hash", "threat": "payload", "malware": "Formbook", "confidence": 100, "first_seen": "2026-11-15 00:58", "source": "ThreatFox" }, { "ioc": "31.57.216.154:10213", "type": "ip:port", "threat": "botnet_cc", "malware": "CECbot", "confidence": 100, "first_seen": "2026-11-15 00:58", "source": "ThreatFox" }, { "ioc": "www.proaktiftumbuhsolusi.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 00:54", "source": "ThreatFox" }, { "ioc": "www.relan-eg.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 00:54", "source": "ThreatFox" }, { "ioc": "www.sohbetozel.org", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 00:54", "source": "ThreatFox" }, { "ioc": "http://182.127.127.181:36072/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-15 00:51", "source": "URLhaus" }, { "ioc": "149.104.166.188:8023", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 75, "first_seen": "2026-11-15 00:45", "source": "ThreatFox" }, { "ioc": "149.104.166.189:8023", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 75, "first_seen": "2026-11-15 00:45", "source": "ThreatFox" }, { "ioc": "149.104.166.190:8023", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 75, "first_seen": "2026-11-15 00:45", "source": "ThreatFox" }, { "ioc": "102.220.161.57:10213", "type": "ip:port", "threat": "botnet_cc", "malware": "CECbot", "confidence": 100, "first_seen": "2026-11-15 00:35", "source": "ThreatFox" }, { "ioc": "www.redlinedivision.id", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 00:34", "source": "ThreatFox" }, { "ioc": "www.medtacglobal.org", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 00:34", "source": "ThreatFox" }, { "ioc": "plantmarcenaria.com.br", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 00:28", "source": "ThreatFox" }, { "ioc": "ammediterrania.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 00:28", "source": "ThreatFox" }, { "ioc": "64.227.188.32:8080", "type": "ip:port", "threat": "botnet_cc", "malware": "Aisuru", "confidence": 100, "first_seen": "2026-11-15 00:25", "source": "ThreatFox" }, { "ioc": "157.245.253.194:8080", "type": "ip:port", "threat": "botnet_cc", "malware": "Aisuru", "confidence": 100, "first_seen": "2026-11-15 00:25", "source": "ThreatFox" }, { "ioc": "http://175.165.196.111:60326/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 00:17", "source": "URLhaus" }, { "ioc": "http://27.44.146.186:48152/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 00:17", "source": "URLhaus" }, { "ioc": "82e54df5989924963a448ac8751d331d8f84690e803f0c9bfb259313507de675", "type": "sha256_hash", "threat": "payload", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 00:16", "source": "ThreatFox" }, { "ioc": "1eab9c72405f45980c573b8fa764436a5635c54d2d8aed39e3e9ef4f026d8445", "type": "sha256_hash", "threat": "payload", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 00:16", "source": "ThreatFox" }, { "ioc": "6ek8lbik.sagex.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-15 00:12", "source": "ThreatFox" }, { "ioc": "aprendizajeeslibertad.cl", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 00:05", "source": "ThreatFox" }, { "ioc": "wl.apaljitu.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 00:05", "source": "ThreatFox" }, { "ioc": "k0f.aprendizajeeslibertad.cl", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-15 00:05", "source": "ThreatFox" }, { "ioc": "www.attorneycollectionservices.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 00:04", "source": "ThreatFox" }, { "ioc": "www.cagliari4u.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-15 00:03", "source": "ThreatFox" }, { "ioc": "https://raw.githubusercontent.com/GeoVisibility/Yunusmakas-konut-fiyat-tahmin-projesi/refs/heads/main/Proje%20Kodlar%C4%B1/projesi_tahmin_fiyat_konut_Yunusmakas_v1.7.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-15 00:03", "source": "URLhaus" }, { "ioc": "http://45.90.81.2:39487/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-15 00:02", "source": "URLhaus" }, { "ioc": "https://yavuzeli-haber.xyz/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-15 00:00", "source": "ThreatFox" }, { "ioc": "https://tokatpumanakliyat.cyou/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-15 00:00", "source": "ThreatFox" }, { "ioc": "https://avinyaaconstructions.com/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-15 00:00", "source": "ThreatFox" }, { "ioc": "https://telepati.cyou/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-15 00:00", "source": "ThreatFox" }, { "ioc": "https://github.com/Privatedocs-1/lipwise/releases/download/v1.0/Software.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-15 00:00", "source": "URLhaus" }, { "ioc": "https://github.com/Privatedocs-1/lipwise/releases/download/v2.0/Release_x64.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-15 00:00", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/NoelHuwae/zack-d-films-ai-video-generator/refs/heads/main/.vscode/keep_ups_chondroendothelioma.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 23:59", "source": "URLhaus" }, { "ioc": "5415abfa039eb9ada217d62e7f5e22bece28d116069b93686b393c82e1719729", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 23:58", "source": "ThreatFox" }, { "ioc": "0d1822a42002f6dbe6b1f17e456ef316c58b47d0c477970850df400bcdecf6a1", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 23:58", "source": "ThreatFox" }, { "ioc": "cb14ae6db4d157ee97c472efbd826819ebbb4ec8c504ef7e596269eb212fe15f", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 23:58", "source": "ThreatFox" }, { "ioc": "c3ec68c3ae7bdc2a48e45d48e6f39c1c8029a944d7b0ee06aae6055ef9073041", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 23:58", "source": "ThreatFox" }, { "ioc": "c92ac6608560229b60d482deca834b7ef21f0a5cb4422371b276df5621bd5d9c", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 23:58", "source": "ThreatFox" }, { "ioc": "0645f12b84d86eda6b12442b2be212959a4d965a3d3aaa24668ac948cedcdaac", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 23:58", "source": "ThreatFox" }, { "ioc": "7797264bee87d92c24aee1ea5e686e31ae99c965d3b9ac61651de805d11f2b6a", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 23:58", "source": "ThreatFox" }, { "ioc": "c9bb9a50ca434c910569bf4ffb9bf6d3ac396c915e2b24474a611d94278189c7", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 23:58", "source": "ThreatFox" }, { "ioc": "64.227.188.32:8001", "type": "ip:port", "threat": "botnet_cc", "malware": "Aisuru", "confidence": 100, "first_seen": "2026-11-14 23:51", "source": "ThreatFox" }, { "ioc": "157.245.253.194:8001", "type": "ip:port", "threat": "botnet_cc", "malware": "Aisuru", "confidence": 100, "first_seen": "2026-11-14 23:51", "source": "ThreatFox" }, { "ioc": "104.248.220.25:8001", "type": "ip:port", "threat": "botnet_cc", "malware": "Aisuru", "confidence": 100, "first_seen": "2026-11-14 23:51", "source": "ThreatFox" }, { "ioc": "201.79.52.69:8001", "type": "ip:port", "threat": "botnet_cc", "malware": "Aisuru", "confidence": 100, "first_seen": "2026-11-14 23:51", "source": "ThreatFox" }, { "ioc": "165.232.36.128:8001", "type": "ip:port", "threat": "botnet_cc", "malware": "Aisuru", "confidence": 100, "first_seen": "2026-11-14 23:51", "source": "ThreatFox" }, { "ioc": "300.ltd", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 23:50", "source": "ThreatFox" }, { "ioc": "www.dinmatpavag.se", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 23:50", "source": "ThreatFox" }, { "ioc": "www.gommoniegadi.it", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 23:49", "source": "ThreatFox" }, { "ioc": "www.koupelny-labuda.cz", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 23:49", "source": "ThreatFox" }, { "ioc": "www.lacompagniadelgiallo.it", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 23:48", "source": "ThreatFox" }, { "ioc": "www.deepellumtexas.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 23:48", "source": "ThreatFox" }, { "ioc": "http://222.127.49.161:44542/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 23:42", "source": "URLhaus" }, { "ioc": "www.gelsintatil.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 23:37", "source": "ThreatFox" }, { "ioc": "www.halalbin.com.bd", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 23:37", "source": "ThreatFox" }, { "ioc": "alexcarniceriacharcuteria.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 23:37", "source": "ThreatFox" }, { "ioc": "summitflow.biz.id", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 23:37", "source": "ThreatFox" }, { "ioc": "http://182.114.197.195:39116/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 23:32", "source": "URLhaus" }, { "ioc": "http://123.5.181.1:50318/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 23:32", "source": "URLhaus" }, { "ioc": "http://183.35.50.78:38590/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 23:32", "source": "URLhaus" }, { "ioc": "https://maltepe-haber.xyz/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-14 23:30", "source": "ThreatFox" }, { "ioc": "https://kayapinar-haber.com.tr/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-14 23:30", "source": "ThreatFox" }, { "ioc": "https://martinworster.co.uk/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-14 23:30", "source": "ThreatFox" }, { "ioc": "advocaat-grimbergen.be", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 23:27", "source": "ThreatFox" }, { "ioc": "www.mypartydeluxe.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 23:27", "source": "ThreatFox" }, { "ioc": "http://222.127.49.161:44542/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 23:22", "source": "URLhaus" }, { "ioc": "http://182.123.164.66:33584/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 23:17", "source": "URLhaus" }, { "ioc": "http://182.122.237.74:42479/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 23:06", "source": "URLhaus" }, { "ioc": "u.gg018.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 23:05", "source": "ThreatFox" }, { "ioc": "gg018.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 23:05", "source": "ThreatFox" }, { "ioc": "c4.appel88.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 23:05", "source": "ThreatFox" }, { "ioc": "31.57.216.91:10213", "type": "ip:port", "threat": "botnet_cc", "malware": "CECbot", "confidence": 100, "first_seen": "2026-11-14 23:02", "source": "ThreatFox" }, { "ioc": "calcuttadiocese.org", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 23:02", "source": "ThreatFox" }, { "ioc": "http://123.5.181.1:50318/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 23:02", "source": "URLhaus" }, { "ioc": "http://182.120.7.115:42940/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 23:02", "source": "URLhaus" }, { "ioc": "http://124.94.187.100:58064/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 23:02", "source": "URLhaus" }, { "ioc": "https://pirilliondesignworks.co.uk/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-14 23:00", "source": "ThreatFox" }, { "ioc": "b1252217508ad6de9ae4889a2b83685b09b827599bfc15ba1496ace87703deeb", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "231d2e5722c4f694e2b18cb324d519e4463733c611049f2bdaf6d3b9bdd49d7a", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "96aa435caf596cb1d696da28bdbbdb80837dab231b6dcc5aafcebec8fda646f8", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "21755f560095abeef5048dbad4fc306a95309c46ec5cbb249366428a7cd88385", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "34dc607abfec1825f846305e1e097d12a5d8ec849887b5e455e29d9f8c552cd8", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "2af0d07529f658ecaa4ad528ea4e59de8739a415ed6b22b0f9cb32c306f8c57e", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "58613eebc2a8246086a91c5f0c85bdfdddb447ec3bcb1539ac392c9e6dc7bc61", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "274180ab59aed5e9061f0f21f9f4f39443ebd891aae4d4bf91af93669232e64d", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "0f9a5c843fc143276d63107600afc02f1d78f34fb99bff21016f8bafe71123ef", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "dba5c398ac11c11efc5499fedc327b95fc9b3e47a00554882a5847f8f204f3d8", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "99057d2757935f0af197440d500a104d112b17d7be5db3dd137a931346686a8c", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "9f54bfb839f983ecf617fef28a944d58a4d399a8c790322c0caa1dcef92e299a", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "a04eb476e7bd929f098f2a0c029e73beaa66125a8a6f1dcbe10fd64292c2d949", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "23e93d6b82464b65fc3642063fe2f13631fbb380db99e384d240bd5d9ff70852", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "64260b499c73a8ed7f8426c3b174b9738e84af114890f77b92668e1051e1efe4", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "fc085b9e6aca7b9cc7f9bf38e056583e37ffd25ae8262a876ca46e1403434228", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "c3313ed03c2c2201052ecc53916c20122285e9f44dff0e1dc893de85f0e094ab", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "ae514ef304890c72b05588dd9b816f499baf4ca3d656c6bd97bb7b92c3cbb285", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "10a3c4fbd87832e458f3ff33634105bf0d427c2c471985d2fef3a30cd562f584", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "5ea588028f3265f790deaab98f1b12b1cc9622996bee32e8d3454972389cdb21", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "36e89bf4506f450ebcaf42a86dd64685e268391e6a101869a96195a0fef417a5", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "54ded999eaa3fb4e353efef5485aff5058d44de586b57f6d0e146647a7e9d7cd", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "1a99f36a4eb1a2ad573422e5e239c78816ccd64394224f4d12d9a01ab34b7be3", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "51f5ed78565a3cd1258d7f758bc8fd4a40db4cef320f342fa9831a93ca8a23d0", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "6979422c2f549a0d84c278300ebace7c0d64fc995ec871fab7c8f7f9f4577a9c", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "407bfcd79ff11277eccd5e68c29f777cb1dbb552804bb038db20a8bd88ae1f35", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "0a24d752c402973201ad7005c96d5e63707fa4e65208b0461a4572c07398c0cc", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "ef69facecb25aa0fb9d70caf0f865937e5509a0f9d2f12fec150c43d3b766d34", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:59", "source": "ThreatFox" }, { "ioc": "http://5.178.101.94/arm/", "type": "url", "threat": "malware_download", "malware": "elf, ua-wget", "confidence": 100, "first_seen": "2026-11-14 22:59", "source": "URLhaus" }, { "ioc": "fba37043987663224bc6be0a01936083371ba75d2cf6007a3c7d66083a4341e4", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:58", "source": "ThreatFox" }, { "ioc": "409b6ca97e040c23d47e37c3035c567e76ceb8e23b5d7f71419c86cde1f854fb", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 22:58", "source": "ThreatFox" }, { "ioc": "9127c0d07e69d7354617a4dd7870172a2c2e00c33f1b46f242b89dfc13811010", "type": "sha256_hash", "threat": "payload", "malware": "WARDENStealer", "confidence": 90, "first_seen": "2026-11-14 22:58", "source": "ThreatFox" }, { "ioc": "0dbc33484a53c3eea19acd21343a9c91a556c9e04773fd7f76787ba94c6c0d5e", "type": "sha256_hash", "threat": "payload", "malware": "WARDENStealer", "confidence": 95, "first_seen": "2026-11-14 22:58", "source": "ThreatFox" }, { "ioc": "87438bce71387f0cb148e2a9b39b6ac7efadb9e7eb0d6be08cd3d179f25d276b", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 95, "first_seen": "2026-11-14 22:58", "source": "ThreatFox" }, { "ioc": "edfc9b7b99ea12758be34c0223e1b9aeb5dcc01b2a99957abd00ed9bd22b730c", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 95, "first_seen": "2026-11-14 22:58", "source": "ThreatFox" }, { "ioc": "c4c735ebaca6666f3fb197022c03ede3485daa4fa2016bfbcd89135b42917222", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 95, "first_seen": "2026-11-14 22:58", "source": "ThreatFox" }, { "ioc": "063a1e469ce2874bb41cf3549d73eada29d94612fad036d10f8088f2be45e8ec", "type": "sha256_hash", "threat": "payload", "malware": "Babadeda", "confidence": 95, "first_seen": "2026-11-14 22:58", "source": "ThreatFox" }, { "ioc": "c16d91e30e17d32d1c61e56c9690cdf5fab9194b41bef5ac9f4ceec02c72a265", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-14 22:58", "source": "ThreatFox" }, { "ioc": "18e61e983be1a7825c5ff9f05e8211f47321988629b518402068ae892c1cb97a", "type": "sha256_hash", "threat": "payload", "malware": "WARDENStealer", "confidence": 95, "first_seen": "2026-11-14 22:58", "source": "ThreatFox" }, { "ioc": "807522a1f1bb9ba74f9a311ba82f9efb18be4b3d679e74ec36262e390bc3b071", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 95, "first_seen": "2026-11-14 22:58", "source": "ThreatFox" }, { "ioc": "9c80a1dcb5df8d0086107a4a3157fc562f4110445b9c3373c4d7e6da648a4761", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 95, "first_seen": "2026-11-14 22:58", "source": "ThreatFox" }, { "ioc": "http://101.108.252.236:59034/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 22:52", "source": "URLhaus" }, { "ioc": "http://27.207.244.226:57464/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 22:50", "source": "URLhaus" }, { "ioc": "http://163.142.79.243:43172/bin.sh", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-14 22:48", "source": "URLhaus" }, { "ioc": "https://github.com/aertexbutton7522/delta-executor/raw/refs/heads/main/delta-executor.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 22:47", "source": "URLhaus" }, { "ioc": "http://125.106.119.93:52040/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 22:47", "source": "URLhaus" }, { "ioc": "http://115.56.152.93:36212/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 22:47", "source": "URLhaus" }, { "ioc": "http://123.14.218.34:58449/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 22:47", "source": "URLhaus" }, { "ioc": "http://42.178.232.134:41401/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 22:45", "source": "URLhaus" }, { "ioc": "olmax.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-14 22:44", "source": "ThreatFox" }, { "ioc": "http://125.43.107.215:59283/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 22:32", "source": "URLhaus" }, { "ioc": "http://78.188.79.84:51515/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 22:32", "source": "URLhaus" }, { "ioc": "http://182.120.7.115:42940/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 22:32", "source": "URLhaus" }, { "ioc": "http://42.177.245.86:35301/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 22:32", "source": "URLhaus" }, { "ioc": "http://61.53.80.155:38509/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 22:26", "source": "URLhaus" }, { "ioc": "http://27.207.244.226:57464/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 22:25", "source": "URLhaus" }, { "ioc": "31.57.184.218:10213", "type": "ip:port", "threat": "botnet_cc", "malware": "CECbot", "confidence": 100, "first_seen": "2026-11-14 22:22", "source": "ThreatFox" }, { "ioc": "vsibester.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "solar-inc.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "sonynewhome.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "sphousing.co.tz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "spingiantonline.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "sportixas.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "sslandscapingny.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "sunriseline.xyz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "supremecasinoroll.net", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "sustainablebrighton.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "takopharma.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "taxreturnfiler.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "telepati.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "tepebasi-haber.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "tesisatkacagibulmak.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "thefreedomcollective.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "thepridehuahin.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "theweddingwalas.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "timelymoversdxb.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "tokatpumanakliyat.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "trynaukri.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "tunitalia.tn", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "usdc.edu.pl", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "veresegyhazegymi.edu.hu", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "vlconcierge.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "vmmtalentcorp.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "wec-net.xyz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "weytk.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "whatsaplus.co", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "yavuzeli-haber.xyz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "yerkoy-haber.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "obxseasalt.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "obattahanlama.id", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "nutrisonia.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "niss.edu.rs", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "neustatus.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "planetoldschool.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "pirilliondesignworks.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "phoenixhomme.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "peterbosherphotography.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "pendiktasimacilik.xyz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "pehavietnam.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "ourlegalindonesia.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "osmaneli-haber.xyz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "sohbetozel.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "slotnivo.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "slotfunguide.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "simalmetal.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "sdelice.fr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "sakaryaweb-tasarim.xyz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "sailingcharterscaribbean.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "sageonthemountain.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "route66foodnfuel.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "rosendalshallon.se", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "roohanihealing.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "rohabuilders.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "renaissancehopemobility.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "relan-eg.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "redlinedivision.id", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "rapididentify.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "qualitytvmounting.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "proaktiftumbuhsolusi.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "poseidonspins.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "poseidonslotgame.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "poseidonarena.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "popcorngourmet.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "opulentworth.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "helloindiatour.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "gommoniegadi.it", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "gue4d.id", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "hackertreats.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "halalbin.com.bd", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "harungencer.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "nauticaloscoglio.it", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "mypartydeluxe.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "mycanvaspage.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "mohamedsohel.co.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "mcdonalds-menus.ca", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "martinworster.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "marsweb.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "maltepe-haber.xyz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "mahadevid999.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "mabuhayxpress.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "luckywagerguide.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "librariaeducativa.ro", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "le-m-solutions.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "lacompagniadelgiallo.it", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "koupelny-labuda.cz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "kjfmission.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "kayapinar-haber.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "kambungu.id", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "jordilex.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "jordanbreeding.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "jackpotoasiscasino.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "jackpotdenzone.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "itbuch.de", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "istanbulantikaalanlar.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "intothefuture.fondazionedimodena.it", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "inicajem.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "improvemasters.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "igamingpt.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "horizonlandmarkinfra.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "holtfarmersmarket.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "healtybeautycare.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "glasspromllc.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "gelsintatil.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "gambleplotworld.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "gamblenestguide.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "freeserverweb.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "floweressencesoffoxmountain.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "firmato.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "fastworkonlines.xyz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "fastforwardd.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "eurofloatshop.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "entertisva.click", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "eaba-com.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "dsjayasinghe.lk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "drsatyamleekha.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "draftwesleycrusher.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "dinmatpavag.se", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "deepellumtexas.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "deb-business.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "dakhina.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "dairyassociation.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "d3tk.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "cruisenewser.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "cleanroomdesign.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "cleanguardcontracting.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "cialisonlinecialispricehnn.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "chinatownmarket.shop", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "changingafricanlivesfoundation.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "carltd.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "casinofiestazone.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "capitalstockbrokers.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "casinocrownlegends.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "casinoforgehub.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "casinosparkonline.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "celebixo.click", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "gokanke.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "anamichelonmediadora.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "cankiriwebtasarim.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "cagliari4u.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "buymedesign.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "brodeco-interior.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "blueprism-showcase.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "bitsebaits.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "bioestetic.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "bestcarebetteryouservices.us", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "beats-entertainment.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "bbcsangbad24.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "basheasy.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "aybasti-nakliyat.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "aventuratrek.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "automotivegearz.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "attorneycollectionservices.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "arteregal.com.es", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "artandindustryinc.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "anyconsulting.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "animeworldindia.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "andyezeani.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "alavicorp.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "alasehirevdenevenakliyat.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "akhisarevdenevenakliyat.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "aiowebmarketing.fr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "agritechvn.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "achimliebold.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:21", "source": "ThreatFox" }, { "ioc": "windowblinds360.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "wirelessoutdoorcinema.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "zengenharia.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "pinnacleunified.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "wastezon.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "ussecurityandprotective.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "srpmineralspvtltd.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "sportscommunity.it", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "somcaregt.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "skyfoxcs.co.za", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "polykretesystems.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "medtacglobal.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "maximcosmetics.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "lovevaughn.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "lioa.info", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "kcengineering.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "kariaboriginalprocurement.org.au", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "kalabaliart.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "janbibi.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "igamesentertainment.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "greenvestminerals.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "fratellifoschiani.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "eflastudio.it", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "drmohanjangidayurved.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "desertdreamadventurecamp.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "bymamase.co.za", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "beninimotocicli.it", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "assochellesespoir.fr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "apegotienda.cl", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "amplavirtual.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "addsomespice.co.za", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "180oneeightyclinic.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-14 22:18", "source": "ThreatFox" }, { "ioc": "http://27.221.140.71:59737/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 22:18", "source": "URLhaus" }, { "ioc": "http://125.106.119.93:52040/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 22:17", "source": "URLhaus" }, { "ioc": "http://78.188.79.84:51515/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 22:17", "source": "URLhaus" }, { "ioc": "http://45.166.188.48:48128/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 22:17", "source": "URLhaus" }, { "ioc": "http://123.14.218.34:58449/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 22:17", "source": "URLhaus" }, { "ioc": "http://115.56.152.93:36212/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 22:17", "source": "URLhaus" }, { "ioc": "ra.appel88.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 22:05", "source": "ThreatFox" }, { "ioc": "59.153.167.12:8899", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 100, "first_seen": "2026-11-14 22:05", "source": "ThreatFox" }, { "ioc": "http://93.152.211.27", "type": "url", "threat": "payload_delivery", "malware": "Unknown RAT", "confidence": 100, "first_seen": "2026-11-14 22:03", "source": "ThreatFox" }, { "ioc": "http://115.59.237.25:48037/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 22:02", "source": "URLhaus" }, { "ioc": "http://27.44.147.26:49761/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 22:02", "source": "URLhaus" }, { "ioc": "http://61.53.80.155:38509/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 22:01", "source": "URLhaus" }, { "ioc": "https://gokanke.cyou/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-14 22:00", "source": "ThreatFox" }, { "ioc": "https://alasehirevdenevenakliyat.com.tr/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-14 22:00", "source": "ThreatFox" }, { "ioc": "https://celebixo.click/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-14 22:00", "source": "ThreatFox" }, { "ioc": "https://aybasti-nakliyat.com.tr/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-14 22:00", "source": "ThreatFox" }, { "ioc": "a203143b443910f3ad26378aa4697bf66678139c8e6e976688408628e689fe1a", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "c303747f3d7948c798d6e794f9466e4d2db4a8110fc8d3f9ce8f44e4d753d3b1", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "128fbe4e6c48ed93bc83ae215e1b739d0a481c91c38cec4569197409b6e9a46e", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "89b38dd2e94b16e4e0e92a6f3f29126de0f166523da762c22c5ba83a33a206ef", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "d067f103ab989bfdf5909d588ed35ff2c2cb317d6766f82069a8c91f224d9548", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "2af415aedf95012383e2797c4bd7d6da70503f9c691a1a92450ace96234a479d", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "7e9e7650d3f2cf5fc79d730356c9c8641c5c8a9c536b2d798c209cf411838c23", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "36a39c2c052a438b0577b2b54e0c56b3a18f8b7a2e774471e2f8a8f8e6aeef34", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "3c168edc6087edf628a3b876498bf84885346e75c246f1cef473d1284ff07ba2", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "946f424e334405498f8de2aa5c8202bd00d49f85e0853d06c9dd4d2dea9f81d1", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "4c5bcaad04646319bad1bbff6dc187267ade973eeec7038fc56be89e272236b4", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "e633d814990beb29e2304ab9b37d199a787c3a75fac55e86f0632d1aba483ad8", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "ee60bf4a19cb791dd4067fa6e4d6807520cec83ad8810b2827f0616b830aaf6c", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "061b8c7550a90ff28be87ad1d90fd3d2d2c3b6f6bcff5bf1de05413a9d4c0ff6", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "57c6a8e4c0ae11989ecdcfaecc155a88e4ace09c35bcda5fd48d45fd0b9693ad", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "00ed07885db1623f23530f08176edf6dc64e3818adeebc43bc8a564997a5b506", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "7ea481d1c5596b6991560ecf5d2c416dc298ba069b5d9f5d153a684ca010d0b5", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "801fbba035ff5d3347556c3f949b1f66a3962d1daee0f7d1d6a25e6f5413ca29", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "bdc84a900d079ff51ae214943e659b8231c1f2902b4d4d7adda205caf04e16c6", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "b90e7f1e6801759f54fed32ee9f247c4aacedd7394ffb55becfa0bfed2dbc271", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "0e19a043b5539dae0a6f8a4be74a08b0c4d267562c1bbb43ada1a7ca4ebe3d5a", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "4570022cdd6e0eae75541e5315ca1f6de1c3830c4787822e4f5915e42d1d5472", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:59", "source": "ThreatFox" }, { "ioc": "b2fcc22fa6a1a459772e061791e9ed9167722b966644642da63d427c3622d0c5", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:58", "source": "ThreatFox" }, { "ioc": "8cbb804ced82a623b84f0de3122ca7b04335f4065301ea507172a9fdb215cf8f", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:58", "source": "ThreatFox" }, { "ioc": "5e5ddefa3f949a8128c417c15a264ca2ad28cf8e932c235bdf26e10f77d83e5f", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:58", "source": "ThreatFox" }, { "ioc": "c5f456000d2f708da8589a706d0bdc2d9dacfb22b44d3b4916bcf3861c3eb4ec", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:58", "source": "ThreatFox" }, { "ioc": "9a9cd9a4d13044548be0ba8e234ec94be1f66e26d4b895ab21714dfff3e9f3b5", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:58", "source": "ThreatFox" }, { "ioc": "8a4cb6e856cd0361bc4d553a1b7fcd3a02b58d1390685aac8509d68d00eb2a61", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:58", "source": "ThreatFox" }, { "ioc": "382570f1ddac7bb252fc1da4d3d0f291ad8e8dda0e258ccb4a5959f8751ddb47", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:58", "source": "ThreatFox" }, { "ioc": "0b286a819d343efd52c1bc062edd8e42dab02c3990db2416ec53d63296cc4d50", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:58", "source": "ThreatFox" }, { "ioc": "e3234a1dfb4c8c269ad9de2bed9d3293b0d7caf93f236149a49ffa59bf4b1319", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 21:58", "source": "ThreatFox" }, { "ioc": "f5c71b28365b039ab501f6e29eff241e69863c027595fd4d1f5c049c415c644f", "type": "sha256_hash", "threat": "payload", "malware": "Nemesis", "confidence": 90, "first_seen": "2026-11-14 21:58", "source": "ThreatFox" }, { "ioc": "8eb3d4e293fc6894afef2ee3d4056a473491b39fcd4dbe91a495e60c9311bc6f", "type": "sha256_hash", "threat": "payload", "malware": "ClipBanker", "confidence": 95, "first_seen": "2026-11-14 21:58", "source": "ThreatFox" }, { "ioc": "add68e988346756c2aa0aba09458c2e00415d35a318c2392ad76290907702834", "type": "sha256_hash", "threat": "payload", "malware": "XWorm", "confidence": 95, "first_seen": "2026-11-14 21:58", "source": "ThreatFox" }, { "ioc": "https://192.69.210.253/client_report", "type": "url", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 100, "first_seen": "2026-11-14 21:57", "source": "ThreatFox" }, { "ioc": "https://raw.githubusercontent.com/Imonholic/veylo/refs/heads/main/src/performance-cpp-high-engine-search-v2.0.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 21:56", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Imonholic/veylo/refs/heads/main/document/books/searchengine/high_cpp_search_performance_engine_1.5.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 21:55", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/internet-dot/git-mcp-rs/refs/heads/main/src/mcp-git-rs-unacclimation.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 21:55", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/internet-dot/git-mcp-rs/refs/heads/main/src/rs-git-mcp-2.6.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 21:55", "source": "URLhaus" }, { "ioc": "http://182.119.206.82:36272/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 21:47", "source": "URLhaus" }, { "ioc": "http://14.20.210.56:37413/Mozi.a", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-14 21:41", "source": "ThreatFox" }, { "ioc": "http://115.59.237.25:48037/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 21:32", "source": "URLhaus" }, { "ioc": "http://115.55.62.175:49486/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 21:32", "source": "URLhaus" }, { "ioc": "http://120.84.214.66:56944/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 21:32", "source": "URLhaus" }, { "ioc": "http://87.227.77.116:51591/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 21:32", "source": "URLhaus" }, { "ioc": "http://222.141.75.71:41996/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 21:31", "source": "URLhaus" }, { "ioc": "buysellpoultry.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-14 21:22", "source": "ThreatFox" }, { "ioc": "http://190.196.253.108:10610/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-14 21:19", "source": "ThreatFox" }, { "ioc": "http://119.30.116.115:44565/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-14 21:19", "source": "ThreatFox" }, { "ioc": "http://115.52.96.107:47075/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-14 21:19", "source": "ThreatFox" }, { "ioc": "http://210.208.110.221:54093/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 21:18", "source": "URLhaus" }, { "ioc": "http://42.224.75.197:53384/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 21:17", "source": "URLhaus" }, { "ioc": "http://182.127.127.181:36072/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 21:17", "source": "URLhaus" }, { "ioc": "d3.appel88.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 21:05", "source": "ThreatFox" }, { "ioc": "http://222.141.75.71:41996/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 21:02", "source": "URLhaus" }, { "ioc": "http://115.55.62.175:49486/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 21:02", "source": "URLhaus" }, { "ioc": "http://182.119.206.82:36272/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 21:02", "source": "URLhaus" }, { "ioc": "http://221.15.9.30:44265/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 21:02", "source": "URLhaus" }, { "ioc": "857e6812bc4a69d515ee06fe1b79c659987eeb2769f0292759bc53696bd59e67", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 20:58", "source": "ThreatFox" }, { "ioc": "http://210.208.110.221:54093/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 20:58", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/eduardopini/nfs-carbon-mac/refs/heads/main/fetched/Software-3.6.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 20:54", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/dolunayozel/cs2-aimbot-wallhack-multitool-esp/refs/heads/SoftMicro_Drapes_Main-dev/OldVersions/ROOTFILES/Drapes_Soft_Micro_2.2.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 20:53", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/eduardopini/nfs-carbon-mac/refs/heads/main/fetched/Software-3.7-alpha.1.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 20:53", "source": "URLhaus" }, { "ioc": "18.239.18.119:443", "type": "ip:port", "threat": "botnet_cc", "malware": "NjRAT", "confidence": 100, "first_seen": "2026-11-14 20:50", "source": "ThreatFox" }, { "ioc": "45.130.84.171:5553", "type": "ip:port", "threat": "botnet_cc", "malware": "NjRAT", "confidence": 100, "first_seen": "2026-11-14 20:50", "source": "ThreatFox" }, { "ioc": "99.86.91.25:443", "type": "ip:port", "threat": "botnet_cc", "malware": "NjRAT", "confidence": 100, "first_seen": "2026-11-14 20:50", "source": "ThreatFox" }, { "ioc": "18.65.39.69:443", "type": "ip:port", "threat": "botnet_cc", "malware": "NjRAT", "confidence": 100, "first_seen": "2026-11-14 20:50", "source": "ThreatFox" }, { "ioc": "timpanogoschorale.org", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "smulsluis.nl", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "summitlawnlandscape.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "symondsonsurveyors.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "toptierstayselitellc.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "truemarkstriping.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "visionandclaritycounseling.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "yavions.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "evergreenlandmanagement.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "novaclean.group", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "lithorion.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "leesmeals.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "oasismanorhouse.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "shareecoin.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "secondchance-recovery.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "riddermanpainting.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "raysroadsideassistance.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "prodetailingllc.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "pelvicfloorphysiotherapy.ir", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "oscarnavarromusic.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "lataragroup.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "kovachconsultants.net", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "kevinwashingtonenterprises.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "kandcpropertymaintenance.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "geckotreecaremi.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "focusresourcedevelopment.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "anchorpointrealtors.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "annemalvetservices.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "bersaqom.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "candor-ags.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "coffeeshopnotarypdx.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "distribucionesgonzalezseijas.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "dotogotr.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 20:48", "source": "ThreatFox" }, { "ioc": "http://222.188.185.67:57472/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 20:47", "source": "URLhaus" }, { "ioc": "https://virtual-video-session.com/Adobe%20Reader.msi", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-14 20:42", "source": "ThreatFox" }, { "ioc": "http://42.224.145.200:44737/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 20:29", "source": "URLhaus" }, { "ioc": "45.198.224.73:10213", "type": "ip:port", "threat": "botnet_cc", "malware": "CECbot", "confidence": 100, "first_seen": "2026-11-14 20:26", "source": "ThreatFox" }, { "ioc": "http://42.225.221.139:35583/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 20:17", "source": "URLhaus" }, { "ioc": "http://124.66.105.240:52245/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 20:17", "source": "URLhaus" }, { "ioc": "http://175.175.22.212:37055/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 20:17", "source": "URLhaus" }, { "ioc": "http://175.175.22.212:37055/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 20:17", "source": "URLhaus" }, { "ioc": "http://115.55.42.126:45133/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 20:11", "source": "URLhaus" }, { "ioc": "o.geng7.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 20:10", "source": "ThreatFox" }, { "ioc": "ty.appel88.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 20:05", "source": "ThreatFox" }, { "ioc": "f.apaljitu.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 20:05", "source": "ThreatFox" }, { "ioc": "c911rjp1.ruhus.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-14 20:05", "source": "ThreatFox" }, { "ioc": "185.162.233.6:8443", "type": "ip:port", "threat": "payload_delivery", "malware": "Stealc", "confidence": 75, "first_seen": "2026-11-14 20:04", "source": "ThreatFox" }, { "ioc": "195.177.94.208:8041", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 75, "first_seen": "2026-11-14 20:04", "source": "ThreatFox" }, { "ioc": "relay.lecoindudiabetique.com", "type": "domain", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 75, "first_seen": "2026-11-14 20:04", "source": "ThreatFox" }, { "ioc": "http://relay.lecoindudiabetique.com:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest", "type": "url", "threat": "malware_download", "malware": "msi, rmm, screenconnect", "confidence": 100, "first_seen": "2026-11-14 20:04", "source": "URLhaus" }, { "ioc": "http://relay.lecoindudiabetique.com:8040/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest", "type": "url", "threat": "malware_download", "malware": "exe, rmm, screenconnect", "confidence": 100, "first_seen": "2026-11-14 20:04", "source": "URLhaus" }, { "ioc": "luegner.top", "type": "domain", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 75, "first_seen": "2026-11-14 20:03", "source": "ThreatFox" }, { "ioc": "http://42.224.145.200:44737/bin.sh", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-14 20:03", "source": "URLhaus" }, { "ioc": "http://182.126.118.25:49782/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 20:02", "source": "URLhaus" }, { "ioc": "http://125.45.64.218:44500/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 20:02", "source": "URLhaus" }, { "ioc": "http://42.229.242.170:45891/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 20:02", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Denys200021/puffinparse/refs/heads/main/client/src/screens/Authentication_system_faradmeter.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 20:01", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Denys200021/puffinparse/refs/heads/main/client/Authentication_system_v1.6.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 20:01", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/CoreStudio2/ferrite/refs/heads/master/src/app/api/recommendations/seller-ops-v2.4.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 20:01", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/CoreStudio2/ferrite/refs/heads/master/src/lib/turso/seller-ops-1.7.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 20:01", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Cyypng/tapline/refs/heads/main/dominus/Auto-Tool-Chameleon-Meccha-Paint-3.4.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 20:01", "source": "URLhaus" }, { "ioc": "9305225f308e95c57c1a2d00d64cb3033710d55c0c9953b5fa42865c4e88e960", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 19:58", "source": "ThreatFox" }, { "ioc": "cad-kon.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 19:51", "source": "ThreatFox" }, { "ioc": "http://115.55.42.126:45133/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 19:47", "source": "URLhaus" }, { "ioc": "http://125.44.219.70:56704/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 19:47", "source": "URLhaus" }, { "ioc": "http://94.244.36.34:52994/bin.sh", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-14 19:43", "source": "URLhaus" }, { "ioc": "http://212.54.86.171:46007/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 19:32", "source": "URLhaus" }, { "ioc": "http://182.126.118.25:49782/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 19:32", "source": "URLhaus" }, { "ioc": "http://42.229.242.170:45891/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 19:32", "source": "URLhaus" }, { "ioc": "http://125.45.64.218:44500/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 19:32", "source": "URLhaus" }, { "ioc": "nunza.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-14 19:24", "source": "ThreatFox" }, { "ioc": "http://125.44.219.70:56704/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 19:17", "source": "URLhaus" }, { "ioc": "http://123.12.236.92:40627/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 19:17", "source": "URLhaus" }, { "ioc": "c6.appel88.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 19:05", "source": "ThreatFox" }, { "ioc": "https://sibel.sbs/ws", "type": "url", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 100, "first_seen": "2026-11-14 19:04", "source": "ThreatFox" }, { "ioc": "sibel.sbs", "type": "domain", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 100, "first_seen": "2026-11-14 19:04", "source": "ThreatFox" }, { "ioc": "https://raw.githubusercontent.com/Chinmay1752/babelscribe/refs/heads/master/server/node_modules/content-disposition/my-luna-3.6.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 19:00", "source": "URLhaus" }, { "ioc": "http://123.12.236.92:40627/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 18:47", "source": "URLhaus" }, { "ioc": "http://125.40.25.12:47861/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 18:47", "source": "URLhaus" }, { "ioc": "webrtwtre22.cc", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 18:41", "source": "ThreatFox" }, { "ioc": "https://github.com/AgentMousePillage/forza-horizon-6-autoshow-unlocker/releases/download/v6.0.0/FH6AutoshowTool.zip", "type": "url", "threat": "malware_download", "malware": "github, MopsStealer", "confidence": 100, "first_seen": "2026-11-14 18:36", "source": "URLhaus" }, { "ioc": "https://github.com/CrewDaimyoMake/WarDogs-Optimizer/releases/download/v1.0.0/WarDogs-Optimizer-v1.0.0.zip", "type": "url", "threat": "malware_download", "malware": "github, MopsStealer", "confidence": 100, "first_seen": "2026-11-14 18:35", "source": "URLhaus" }, { "ioc": "http://115.54.167.131:42115/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 18:32", "source": "URLhaus" }, { "ioc": "schneemann.cfd", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 18:27", "source": "ThreatFox" }, { "ioc": "http://45.168.132.19:52454/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 18:21", "source": "URLhaus" }, { "ioc": "31.56.19.143:15987", "type": "ip:port", "threat": "botnet_cc", "malware": "Potassium", "confidence": 100, "first_seen": "2026-11-14 18:14", "source": "ThreatFox" }, { "ioc": "https://github.com/user-attachments/files/16913125/Software.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 18:06", "source": "URLhaus" }, { "ioc": "pt.appel88.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 18:05", "source": "ThreatFox" }, { "ioc": "appel88.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 18:05", "source": "ThreatFox" }, { "ioc": "130.94.11.208:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-14 18:05", "source": "ThreatFox" }, { "ioc": "http://125.40.25.12:47861/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 18:02", "source": "URLhaus" }, { "ioc": "http://27.19.83.71:44735/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 18:02", "source": "URLhaus" }, { "ioc": "215e9a36cd2e2e9e1966ef18d68d95e298cee3d2011b565633e2c06842c53a38", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 17:58", "source": "ThreatFox" }, { "ioc": "http://45.168.132.19:52454/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 17:54", "source": "URLhaus" }, { "ioc": "https://github.com/Fiendvanspike/meccha-chameleon-trainer-2026/releases/download/v3.0.0/MecchaTrainer.zip", "type": "url", "threat": "malware_download", "malware": "github, MopsStealer", "confidence": 100, "first_seen": "2026-11-14 17:43", "source": "URLhaus" }, { "ioc": "https://lafrancefabrics.screenconnect.com/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest&c=PRACTICE%20MANAGER", "type": "url", "threat": "payload_delivery", "malware": "Unknown RAT", "confidence": 90, "first_seen": "2026-11-14 17:42", "source": "ThreatFox" }, { "ioc": "http://42.235.181.203:52850/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 17:38", "source": "URLhaus" }, { "ioc": "http://27.19.83.71:44735/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 17:32", "source": "URLhaus" }, { "ioc": "http://124.6.167.113:53935/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 17:19", "source": "URLhaus" }, { "ioc": "http://42.235.181.203:52850/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 17:08", "source": "URLhaus" }, { "ioc": "m.geng7.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 17:05", "source": "ThreatFox" }, { "ioc": "jxv.appel4d.com", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 17:05", "source": "ThreatFox" }, { "ioc": "p9z5yvie.rodac.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-14 17:05", "source": "ThreatFox" }, { "ioc": "45.116.78.205:80", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 100, "first_seen": "2026-11-14 17:05", "source": "ThreatFox" }, { "ioc": "http://42.4.117.93:39987/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 17:02", "source": "URLhaus" }, { "ioc": "http://42.58.211.118:49262/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 17:02", "source": "URLhaus" }, { "ioc": "https://pdfdocumentsharepoint.com/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-14 17:00", "source": "ThreatFox" }, { "ioc": "https://cdn.discordapp.com/attachments/1567313157385363520/1571251448811884607/44a5a40375?ex=6afa0d71&is=6af8bbf1&hm=58c4eb0cdc5d28991924500f333e3e8a725918391a1ffb926724709059f978f7&", "type": "url", "threat": "malware_download", "malware": "IRAHook", "confidence": 100, "first_seen": "2026-11-14 17:00", "source": "URLhaus" }, { "ioc": "exportrelay.net", "type": "domain", "threat": "payload_delivery", "malware": "XMRIG", "confidence": 80, "first_seen": "2026-11-14 16:57", "source": "ThreatFox" }, { "ioc": "45.9.148.86:45876", "type": "ip:port", "threat": "payload_delivery", "malware": "XMRIG", "confidence": 80, "first_seen": "2026-11-14 16:57", "source": "ThreatFox" }, { "ioc": "185.106.98.235:8888", "type": "ip:port", "threat": "payload_delivery", "malware": "XMRIG", "confidence": 80, "first_seen": "2026-11-14 16:57", "source": "ThreatFox" }, { "ioc": "159.69.58.170:80", "type": "ip:port", "threat": "payload_delivery", "malware": "XMRIG", "confidence": 80, "first_seen": "2026-11-14 16:57", "source": "ThreatFox" }, { "ioc": "103.210.144.11:80", "type": "ip:port", "threat": "payload_delivery", "malware": "Mirai", "confidence": 80, "first_seen": "2026-11-14 16:57", "source": "ThreatFox" }, { "ioc": "https://raw.githubusercontent.com/bytheroberto/pocketvibe/refs/heads/main/polyscopic/groq-conversational-chatbot-melezitose.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 16:56", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/bytheroberto/pocketvibe/refs/heads/main/polyscopic/conversational_chatbot_groq_2.3.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 16:56", "source": "URLhaus" }, { "ioc": "http://124.6.167.113:53935/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 16:55", "source": "URLhaus" }, { "ioc": "nordo.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-14 16:49", "source": "ThreatFox" }, { "ioc": "http://163.142.79.243:43172/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 16:47", "source": "URLhaus" }, { "ioc": "http://222.138.183.92:51987/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 16:47", "source": "URLhaus" }, { "ioc": "http://5.166.33.157:23299/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 16:47", "source": "URLhaus" }, { "ioc": "http://5.166.33.157:23299/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 16:47", "source": "URLhaus" }, { "ioc": "95.133.229.17:5000", "type": "ip:port", "threat": "botnet_cc", "malware": "Evilginx", "confidence": 75, "first_seen": "2026-11-14 16:45", "source": "ThreatFox" }, { "ioc": "82.148.239.8:56001", "type": "ip:port", "threat": "botnet_cc", "malware": "PureRAT", "confidence": 75, "first_seen": "2026-11-14 16:45", "source": "ThreatFox" }, { "ioc": "45.156.87.167:7777", "type": "ip:port", "threat": "botnet_cc", "malware": "PureRAT", "confidence": 75, "first_seen": "2026-11-14 16:44", "source": "ThreatFox" }, { "ioc": "45.141.21.125:56001", "type": "ip:port", "threat": "botnet_cc", "malware": "PureRAT", "confidence": 75, "first_seen": "2026-11-14 16:44", "source": "ThreatFox" }, { "ioc": "4.235.120.72:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-14 16:44", "source": "ThreatFox" }, { "ioc": "209.99.190.30:4323", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 75, "first_seen": "2026-11-14 16:44", "source": "ThreatFox" }, { "ioc": "196.251.121.237:7777", "type": "ip:port", "threat": "botnet_cc", "malware": "DCRat", "confidence": 75, "first_seen": "2026-11-14 16:44", "source": "ThreatFox" }, { "ioc": "186.169.91.36:5020", "type": "ip:port", "threat": "botnet_cc", "malware": "DCRat", "confidence": 75, "first_seen": "2026-11-14 16:43", "source": "ThreatFox" }, { "ioc": "186.169.91.36:5012", "type": "ip:port", "threat": "botnet_cc", "malware": "AsyncRAT", "confidence": 75, "first_seen": "2026-11-14 16:43", "source": "ThreatFox" }, { "ioc": "186.169.91.36:5011", "type": "ip:port", "threat": "botnet_cc", "malware": "AsyncRAT", "confidence": 75, "first_seen": "2026-11-14 16:43", "source": "ThreatFox" }, { "ioc": "186.169.91.36:5010", "type": "ip:port", "threat": "botnet_cc", "malware": "AsyncRAT", "confidence": 75, "first_seen": "2026-11-14 16:43", "source": "ThreatFox" }, { "ioc": "185.241.208.120:7222", "type": "ip:port", "threat": "botnet_cc", "malware": "PureRAT", "confidence": 75, "first_seen": "2026-11-14 16:43", "source": "ThreatFox" }, { "ioc": "18.136.4.30:4444", "type": "ip:port", "threat": "botnet_cc", "malware": "Havoc", "confidence": 75, "first_seen": "2026-11-14 16:43", "source": "ThreatFox" }, { "ioc": "173.195.100.55:443", "type": "ip:port", "threat": "botnet_cc", "malware": "PureRAT", "confidence": 75, "first_seen": "2026-11-14 16:43", "source": "ThreatFox" }, { "ioc": "169.58.38.91:4498", "type": "ip:port", "threat": "botnet_cc", "malware": "AsyncRAT", "confidence": 75, "first_seen": "2026-11-14 16:43", "source": "ThreatFox" }, { "ioc": "167.17.74.9:25340", "type": "ip:port", "threat": "botnet_cc", "malware": "PureRAT", "confidence": 75, "first_seen": "2026-11-14 16:43", "source": "ThreatFox" }, { "ioc": "153.79.249.159:5000", "type": "ip:port", "threat": "botnet_cc", "malware": "Evilginx", "confidence": 75, "first_seen": "2026-11-14 16:43", "source": "ThreatFox" }, { "ioc": "134.255.218.122:56001", "type": "ip:port", "threat": "botnet_cc", "malware": "PureRAT", "confidence": 75, "first_seen": "2026-11-14 16:43", "source": "ThreatFox" }, { "ioc": "134.255.218.122:56002", "type": "ip:port", "threat": "botnet_cc", "malware": "PureRAT", "confidence": 75, "first_seen": "2026-11-14 16:43", "source": "ThreatFox" }, { "ioc": "117.55.237.88:4321", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 75, "first_seen": "2026-11-14 16:43", "source": "ThreatFox" }, { "ioc": "39.108.102.94:31337", "type": "ip:port", "threat": "botnet_cc", "malware": "Sliver", "confidence": 100, "first_seen": "2026-11-14 16:41", "source": "ThreatFox" }, { "ioc": "124.156.204.199:31337", "type": "ip:port", "threat": "botnet_cc", "malware": "Sliver", "confidence": 100, "first_seen": "2026-11-14 16:40", "source": "ThreatFox" }, { "ioc": "103.236.55.218:31337", "type": "ip:port", "threat": "botnet_cc", "malware": "Sliver", "confidence": 75, "first_seen": "2026-11-14 16:39", "source": "ThreatFox" }, { "ioc": "121.89.84.167:31337", "type": "ip:port", "threat": "botnet_cc", "malware": "Sliver", "confidence": 75, "first_seen": "2026-11-14 16:36", "source": "ThreatFox" }, { "ioc": "http://202.1.26.21:53728/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 16:32", "source": "URLhaus" }, { "ioc": "http://110.186.228.185:42394/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 16:32", "source": "URLhaus" }, { "ioc": "http://49.70.25.163:53888/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 16:32", "source": "URLhaus" }, { "ioc": "http://42.58.211.118:49262/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 16:32", "source": "URLhaus" }, { "ioc": "http://115.49.15.81:57441/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 16:21", "source": "URLhaus" }, { "ioc": "http://79.106.74.163:59895/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 16:18", "source": "URLhaus" }, { "ioc": "http://49.70.25.163:53888/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 16:17", "source": "URLhaus" }, { "ioc": "bo.appel4d.com", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 16:05", "source": "ThreatFox" }, { "ioc": "zo.apaljitu.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 16:05", "source": "ThreatFox" }, { "ioc": "191.107.80.209:6001", "type": "ip:port", "threat": "botnet_cc", "malware": "Quasar RAT", "confidence": 100, "first_seen": "2026-11-14 16:05", "source": "ThreatFox" }, { "ioc": "210.56.48.188:8888", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 16:05", "source": "ThreatFox" }, { "ioc": "107.149.96.10:10086", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 100, "first_seen": "2026-11-14 16:05", "source": "ThreatFox" }, { "ioc": "45.207.208.51:22", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-14 16:05", "source": "ThreatFox" }, { "ioc": "62.85.91.36:8808", "type": "ip:port", "threat": "botnet_cc", "malware": "AsyncRAT", "confidence": 100, "first_seen": "2026-11-14 16:05", "source": "ThreatFox" }, { "ioc": "http://182.127.128.166:56957/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 16:02", "source": "URLhaus" }, { "ioc": "http://193.163.187.230:45909/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 16:02", "source": "URLhaus" }, { "ioc": "hdrichmondstag.wpengine.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 16:01", "source": "ThreatFox" }, { "ioc": "wordpress-1226367-4631498.cloudwaysapps.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 16:01", "source": "ThreatFox" }, { "ioc": "https://cdn.discordapp.com/attachments/742704845508575294/1571237306239811664/4e6d3db966?ex=6afa0045&is=6af8aec5&hm=fefebc555223e01ba05073a8de2bac6bcae97775c47397db630c73c9e5961375&", "type": "url", "threat": "malware_download", "malware": "IRAHook", "confidence": 100, "first_seen": "2026-11-14 16:00", "source": "URLhaus" }, { "ioc": "b43866cec329650bff964813ff8cebb93b50a537434ff7fc561a542891f74e8d", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Stealer", "confidence": 95, "first_seen": "2026-11-14 15:58", "source": "ThreatFox" }, { "ioc": "http://182.122.237.74:42479/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 15:54", "source": "URLhaus" }, { "ioc": "31.57.216.212:10213", "type": "ip:port", "threat": "botnet_cc", "malware": "CECbot", "confidence": 100, "first_seen": "2026-11-14 15:53", "source": "ThreatFox" }, { "ioc": "https://cdn.discordapp.com/attachments/1275200554829873255/1571234122339324015/90177c64c9?ex=6af9fd4e&is=6af8abce&hm=c64536408f8dbf1e7a9ee84615085141569a8db534e2412fa3cf613ccf91f88b&", "type": "url", "threat": "malware_download", "malware": "IRAHook", "confidence": 100, "first_seen": "2026-11-14 15:47", "source": "URLhaus" }, { "ioc": "http://115.56.59.82:36575/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 15:47", "source": "URLhaus" }, { "ioc": "31.7.60.154:85", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-14 15:39", "source": "ThreatFox" }, { "ioc": "http://193.163.187.230:45909/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 15:32", "source": "URLhaus" }, { "ioc": "http://46.41.123.69:60867/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 15:32", "source": "URLhaus" }, { "ioc": "http://160.30.109.25:55665/Mozi.a", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-14 15:19", "source": "ThreatFox" }, { "ioc": "http://100.10.1.135:34861/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-14 15:19", "source": "ThreatFox" }, { "ioc": "http://42.227.133.23:35155/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 15:18", "source": "URLhaus" }, { "ioc": "http://115.56.59.82:36575/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 15:17", "source": "URLhaus" }, { "ioc": "2q942xck.rochi.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-14 15:15", "source": "ThreatFox" }, { "ioc": "http://157.66.146.183:36834/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 15:14", "source": "URLhaus" }, { "ioc": "5ecf14994419b1f8b5d9a8d60623ce2cffa7f4b6ecec1751100d5b7a71302313", "type": "sha256_hash", "threat": "payload", "malware": "kkRAT", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "1fd6f65f7a6626dda9b7bd8c82c18ae22be95e1a", "type": "sha1_hash", "threat": "payload", "malware": "kkRAT", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "f01933e12039d516f14b61b6cc303a0c", "type": "md5_hash", "threat": "payload", "malware": "kkRAT", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "7c9baba95531d4c908f15c9befbde8a56a1114c2e006c969695ec0a0de7878e4", "type": "sha256_hash", "threat": "payload", "malware": "kkRAT", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "a2b4e06181d15e3d5384d65cb6cf8793", "type": "md5_hash", "threat": "payload", "malware": "kkRAT", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "7cc466a1da22db8671a178a80a976626a12d9a27", "type": "sha1_hash", "threat": "payload", "malware": "kkRAT", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "99be07a212f36deae58e7b1515abb080", "type": "md5_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "e309f32903408d9905c4865fada530331c0bca22", "type": "sha1_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "baed59715b1cd5c31f10172d38af9f8f7d6eae5b6cdf045c5212e05d06b093cd", "type": "sha256_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "570dd04491a56ae3b0ae916cea6b89f73e1811d8", "type": "sha1_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "a4c66dac353589c79de43e3df37f7c41", "type": "md5_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "924224c6a919a869efee395f69dce99fe1a76d35bef71a49422a88e448a09ee4", "type": "sha256_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "c55f494f75b7c64c1fad204711a13960", "type": "md5_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "073ff8f74b87f7a91db184e1962ac3e6", "type": "md5_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "8e5dadc3e663e6a9efbfc2f7a5272b39a4accdb4", "type": "sha1_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "aaa05c178844b47e2e9e80a61af679d576cae6eaad26ab7e589cb7da0cdea9a1", "type": "sha256_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "b63c54cfdc47bfc3fb01177a3b0e07d146188b22", "type": "sha1_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "f942d3eac52a29a2254cab485253a572c5a985618a35c4cc853fcde2e034d675", "type": "sha256_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "229de7f7340d45e74749978d25f99deb", "type": "md5_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "1c741595f6392c2d6167648a9563e1650b0f001ecd2655aa7dac6557f0cd0895", "type": "sha256_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "fcc829f4a247883d5310ab4b20e6d45082501ec8", "type": "sha1_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "76b2f4634f805a29604346adcef2a566", "type": "md5_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "d79f8157bbe699679fee210fc9579a21ac781910", "type": "sha1_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "c7ca0bbc581814ed0579a7eb6718a675ca6ae83eaf52caa96a00a70eee9b8865", "type": "sha256_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "5f41323f4d0bc83a13b9859fe03db8aa3c13a0779bf69ea507e0ba9cf9f620d1", "type": "sha256_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "4870f4e9201fba626a2c8819bd01c647", "type": "md5_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "0a492aacabe76b92a0afe4660dc8fe175d91a817", "type": "sha1_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-14 15:13", "source": "ThreatFox" }, { "ioc": "57fd6e1595f6de6441ab0db00c5d750a", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "3817933ffc4096be3cbad2f690ec026f", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "1958ce8b298ff89b0d773b9be8a5a1dcef2dec54", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "55a1daee46dd580d7c2fc7ec015790c8b23c18fc225894d920613c8cc30ab12f", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "f011be3c56da0aa34eecd6ac6fba8b82", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "0c93e7fdddca0d2bb2e9662a119a7ea1a6a433f1543749aa2a759cf4d8aba6be", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "2900ac50dca3f3e6bbe41af908e78a6bfbb7c88d", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "28e7431d343b49fd7300bb20fac99b07de641022", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "bf3bf44b3261049861c36085a97bfd9f", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "26faf1933d276fb415b46e6574d8e038a46f6e32", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "bf1a5d04194302c8032ae3e8958516bd", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "a55896f3e814533e03c7b0a684f73406e9049c2b", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "afd3abf5ced28726d94a215bd17389ec", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "0f84c9c18ed5b87b152dee3d20b8a4d06edb3020", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "0ab9c42ee92c0d872bde106aaddecb6334d17ed1", "type": "sha1_hash", "threat": "payload", "malware": "Coinminer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "8b91d4995253c30ad8cf7870fb7f5f48", "type": "md5_hash", "threat": "payload", "malware": "Coinminer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "a8a243d77152dc6cf46c351441ea3165", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "7f3d4823a5bef0bb82019098e57697d0195e91b8", "type": "sha1_hash", "threat": "payload", "malware": "ValleyRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "b05ab82e969f5f9e5b85ebf8d06b9f17", "type": "md5_hash", "threat": "payload", "malware": "ValleyRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "dddc1afb119fa58ef0c9cf653fcac8f42c47d7c5", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "e95064404181c29541515a590a1e71d1", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "9e9f562b4a45eb1aabbbc404f1ecd3424068654a", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "9bdee65ffa5c09eda6c74a4f3d4bee6d", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "9a67c8e3a1347ef22695947d6f879e0fc91b9cbe", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "0d5068606893fdd667ec18b2e27c4599", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "0103b0ba3ff9fdc9a0e1a66bdef9f1acc5fcd999", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "a293b28028115d676fca89e38fe8a441", "type": "md5_hash", "threat": "payload", "malware": "AdaptixC2", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "5808ae87aaa4ba1a26a3766f995a08413189a72c", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "2195efcee5ba73a889c8420fc376099445d43b90", "type": "sha1_hash", "threat": "payload", "malware": "AdaptixC2", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "eb1746f5f5a99874f7e51b0d4d3a216f", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "b3802a2f1a5be70d83afba972af67ffe", "type": "md5_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "ce1be8e1e7119519872fe26ef4f995e94bcc3bed6915d1eca22650c9688ade51", "type": "sha256_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "2970ab14673626980da46a594d91ad4d83be969a", "type": "sha1_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "b51fca5697c50b4ad0abbd91a0d0fcf5", "type": "md5_hash", "threat": "payload", "malware": "Coinminer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "7652afac06acfaaacd56858a20e055ce", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "a2f697c209de9d4e89384729b1a9b022e457180c", "type": "sha1_hash", "threat": "payload", "malware": "Coinminer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "0509f447aadf74b026c86d8d78f9fc58034a1c81", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "42f50db7ca63c3cc03938ceae4374bfbdd671a2c", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "12003c202d993685ce7f54663d9ae66b", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "d0a2be4551064c50cf519634dee3201cce08c5b6", "type": "sha1_hash", "threat": "payload", "malware": "NetWire RC", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "0435bb0a9892093b9e6caa564fb7d55c", "type": "md5_hash", "threat": "payload", "malware": "NetWire RC", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "8903b120b67d13cc694f028e1e7b5cd141636a54", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "9c7696e3b9f550450d4bdfc931cdb99ae7eb92689e5fd4c4ab4159d6f462a376", "type": "sha256_hash", "threat": "payload", "malware": "NetWire RC", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "7a050b7cdc7ee533a637cb7cdf38ccaf", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "3bde6d5aba98c766cc41fd79a0141153", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "0f7e98f5ecd56c492cea20f43230eb73b4190230", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "84df9d2314d7be945b989ec5967b5ad2", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "d20854cae980268390822f23cabe88b4eb7b7bd4", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "62c66deba94eb51f268ff10c6d8565f5fc52a9cd67819d243f85b672ee13a872", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "7cc25378c150c928ba8cb273799885f6fa60de6f", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "d821b5a1651471b42b5422682fbf90a6", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "6aba524ad21987051876218357b54ac63be6bc36", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "b44bf93c783f9bf5e01eaae18073d7e2", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "c6758782130ee8901dda3cb4e204d024", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "70ffad5b7c728899de393b96b697f83a5015d9a4ab70c336126832281c646509", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "8219c601aec2465a74ab251cd5c03eb5689fa5e389192d96dfee218399aa67aa", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "9fa3225aa13a8fd1db70ed03ec5fdad60c8d1e57", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "fdeed4bbb15996a5a11f7038740cceefb80e89c7e2e0b9db7c74f18dded3c9e4", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "bcde03f9d0f55392117d48657b12b946", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "0d068140197f813e4f990d79b4d4fba6787cdeb5", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "9f920216394dd90e679fc00760ac1b1d7f1bf74d", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "2eef62668e8a3ef3124b823f990809c8", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "e2b9022fd77b4f7de9c9498db88aaca8", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "46080f459577529059ace98473cfd80693744444c8ef828ff5f7377eb10906a0", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "ac3f87b82fff745ceda0ad9d0cd09bb4de22b61a", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "95e51af6466899ab0a1f204716a1d7eac3accc58", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "b533bbf00d28721b87e58052a26ebdbd8183cafa0eb30f1ba639818a07cb0d6c", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "69420afe2ffe9d4e5c9de7f811cb43b2", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "79385e3c89f86ef1f45d66ad1d249b54", "type": "md5_hash", "threat": "payload", "malware": "YiBackdoor", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "3c9b11a05c2d8701da8afaffd9e9b68816191c0e107162dba6c3dc1fabc80c96", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "33bb5f17c30d278694f63af25a4cbdf0a5a545c5", "type": "sha1_hash", "threat": "payload", "malware": "YiBackdoor", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "3647f1dd11b4a28e65e03c997b14f1507cfb07ffc412f4b5790dd2b4ec293f92", "type": "sha256_hash", "threat": "payload", "malware": "YiBackdoor", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "5fff315917c102d44430d45cdb48c926", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "194f4b38b5cd11c5115af97b46156c156286d661", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "6f4ccc1718eddb12fab554f0c19e908f0486fd734bb02c706534ad92860d5df2", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "43525f10a89e521ba2884d308adefbf8", "type": "md5_hash", "threat": "payload", "malware": "Coinminer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "129a73a6619d5b8184265f130e5e99a7776e5a4e", "type": "sha1_hash", "threat": "payload", "malware": "Coinminer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "d61bb5af4b2b1aeeb7bd03c2afd2801d1a3c9bf8c9dab61ccf1dc7c1cd6fb1c4", "type": "sha256_hash", "threat": "payload", "malware": "Coinminer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "4207523717b12dcbc8587bca72a7aca4a274823f3ca14c1e8ede7b2ca792798b", "type": "sha256_hash", "threat": "payload", "malware": "SnappyClient", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "1206cb52fd113ba2ad8ba259c5a8682427c3f08e", "type": "sha1_hash", "threat": "payload", "malware": "SnappyClient", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "890afefecc2c1ef0fca404160082604f", "type": "md5_hash", "threat": "payload", "malware": "SnappyClient", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "e27af31479a869818aedc47cf80c4810a0a7880b", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "c51d39bf1109c2e39cbca82ac8747f51", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "9249268a2808ef5c8a209a3cb1e378ffb341598a8e205c74b5911317e856dfcf", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "1ac05af367e3bdaeb1e5739321f389bb", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "27bb266bbea5e5f7f570d91083f1e473c67ffe6c", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "5c4c829af18020bade14bf27d8da16c636ed390ba459cf0965d7d374bf60e7c3", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "bdf45f1d0b0f402448f29c5065af01c2a9213407", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "c0f7fe5744fa2e2f70e5ccd245f72a50f0e9ff3ee5f11010ac99bbcd6f329aa5", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "23ff5d33a24096da70940a5e18ae890b", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "a6f0dc3f900d7047bdb458ce919255f554cf03b3", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "391d5c7fdafc8bf0eeaa1e28c4863d8e", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "36c22c2f0a3a18e81eb0565729e55e51", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "38ada6ba9200ba8ab44a59b541492e44dbfb806338cd60ea6cf18f70abac216f", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "f1d177fd6752b40fbb6a53a76d0a7de76819d73bd87c01bd6add0c37046e916d", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "36e6c20adfbd327760f72a34d564ed9d2da24bb7", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "fefe1d0b39bf94dc5fbca15a6a86b4a9", "type": "md5_hash", "threat": "payload", "malware": "AdaptixC2", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "ba2813e1aa42bf6f419586c65a84f8e2177ba7e3", "type": "sha1_hash", "threat": "payload", "malware": "AdaptixC2", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "4efd92c2646b0bc482ec174b5a9d6afa30d4ca06", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "7fa0e1a599b3661e06de5a98694df91b", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "26dbf062fa2ababe0125ab6e7f2ac3bac9a70facf54c8e2b38e65d618d7cb23c", "type": "sha256_hash", "threat": "payload", "malware": "AdaptixC2", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "e664de4eac009b8417d8832d34940d876256e9752aa587cecb6f0ad843f72ad1", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "8d7215fb5ac844d06062c56d931ce912", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "2a7339f1241e89d7918549f72d4c9639f49d63b3", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "ae80863fd98d887bb70aa7f8c4ff5fa85251a4b9092699769840ea09df3a4543", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "2515ef00269035c25cb6a7b56debb6ac", "type": "md5_hash", "threat": "payload", "malware": "TinyLoader", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "2571e740bf94d78ac1914dc702aad21eac51f31c", "type": "sha1_hash", "threat": "payload", "malware": "TinyLoader", "confidence": 95, "first_seen": "2026-11-14 15:12", "source": "ThreatFox" }, { "ioc": "cfbe95402662013bc58dada3a5424a4519883fc4", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "e087bfa71a879069491b2097e75a3b3301713a10715e2b544e8703b3b4a2ec9f", "type": "sha256_hash", "threat": "payload", "malware": "TinyLoader", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "f1ba1aa49081c49f15865860e7ad521b", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "b3c04ff117162bfd32c3fbb7a632f72ef8442222fda0645ac9eab3a2f9587e20", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "ec8b3d06e3ff5af7437116100d915d0b", "type": "md5_hash", "threat": "payload", "malware": "ValleyRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "3ccbabf2c183855c9a6265d295951ae753e49364", "type": "sha1_hash", "threat": "payload", "malware": "ValleyRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "27c179a96f38ec75040760c6d4dbabbc147bb5bd20c6d6255a3ae2c80a081b50", "type": "sha256_hash", "threat": "payload", "malware": "ValleyRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "1e8d8c2c395410af4f1dfeeade015701", "type": "md5_hash", "threat": "payload", "malware": "WannaCryptor", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "ceac9e49264190c6562c1c592a92a2738c56af31", "type": "sha1_hash", "threat": "payload", "malware": "WannaCryptor", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "2a51c732248de5d17647741009b5223c", "type": "md5_hash", "threat": "payload", "malware": "WannaCryptor", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "72f38226f002154975bf4f3031255156fcf9ecc2", "type": "sha1_hash", "threat": "payload", "malware": "WannaCryptor", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "a947e19ee6e1e28113205ae36579011ec35455317a2bbcf632d4b55bf39e4174", "type": "sha256_hash", "threat": "payload", "malware": "WannaCryptor", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "7b52be1e9dcfe72376319d5abc96cb00", "type": "md5_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "c045beabd738db955b47ed7d7434107b169e7344", "type": "sha1_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "690638f098adb2a5940c2409a412626fb95aa6bfb38a3b9c151008fb99274391", "type": "sha256_hash", "threat": "payload", "malware": "WannaCryptor", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "48c0d8c470452c6274156147d6467d242b6c241f4a9a6be1a7417155769cd4c9", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "b74cd8fc1f99f6e5e3aa7d28134c3054", "type": "md5_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "168970dcc622d2bd59d89eeb78dbbd3781dbfb83", "type": "sha1_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "3a26669bdd394aaf4206161a6b302deaded2410d", "type": "sha1_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "9553588c6eda1b492fcafee60dc628da85e47e22b940addd8fa8938defb62688", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "99f147486b8663bd6ac3eb9349edeb3c", "type": "md5_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "c97a9593d86bfdb4a8b7a035f983a590", "type": "md5_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "50674b0276a7d6544bd8dfded2857e8b95a7690234a0687ed60958a96596090c", "type": "sha256_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "de84b717a3226e49fef1bc017f325ef1d550aed0", "type": "sha1_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "3e62aa763e960293cff3422f67c29f40", "type": "md5_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "048fd927062cb3452b766f63221d2b73ce0412a812078b306548a80824699105", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "02315842a5b8c381b2ab83e2dba7393511c02ef7", "type": "sha1_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "5b6973beb48d12727ebb40724b31e03aa60cadb2", "type": "sha1_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "85fffaa78e32059f5be3572c9d60f57eb04f90108086691e351c5089f1b0023d", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "4c3611aac028c23b0a737685039fa662", "type": "md5_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "8074ba611883600d45b553134754ad4b1bf46cf2", "type": "sha1_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "feb7619915910d7f68ea3ec2af425781e38c6a194ba019ab972def8aa971045a", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "463e8b415e2cb0b07cc04b68a69bedcb", "type": "md5_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "730f4ae80cf7b0ce69d50decbf835a54771881c75f4427f275ce6d580b43c6a9", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "cfc0c3c507c8d9e5c9548732ffd541b3a61e4e9f", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "dc7e6267a257a4a6b17d120c7943aec5", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "9f0346d0bb09eae27177b9f5f44efcab33ab6e1cd4782bf815b6dd94cb11d7fa", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "dc4fb6036ad95db48cc7312a401adda9", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "7547089fe30716986b6844b0d5c10c93e70c3391", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "0401774f0271b2b66dcf8051986054a4d9cf945c47a452fc8ed258d9de6d75c6", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "09ffd1e6d1b5041324dbededdf09a874", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "f748151f1e0134febdf8857de24d72d58ef35d53", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "7c1f94c62ae58062564b12875f3f0909e6f124787db04d2288bf2516c54542f4", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "693e93d5d5a4693fa58aabc71ea2a074", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "bdde56eab8a97296ccc8f005cd88b4cfa9eaa0b4", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "b38bc3df6ff8b00aeb976c80c411e03bb0175299f10a7ea36e369027152faf21", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "d1874a4fae23a0ab5986cc90f7ce565b", "type": "md5_hash", "threat": "payload", "malware": "Venus Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "fe160d81ccd66b4674703f9924bf087dd259eda1", "type": "sha1_hash", "threat": "payload", "malware": "Venus Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "7dac6de2254f38ca7bd8a3f9ac462b45001bb5d527274732fd35723a3215475c", "type": "sha256_hash", "threat": "payload", "malware": "Venus Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "ed3fb8a6afd9f8d624e050a7641352d4", "type": "md5_hash", "threat": "payload", "malware": "Venus Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "d21f87781dab15d16b954fcb2c6602fcf7cd3cc0", "type": "sha1_hash", "threat": "payload", "malware": "Venus Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "f03f7ac94f67565bf433896495782ba3fbeed46554ee0ec9fae9de925489f16a", "type": "sha256_hash", "threat": "payload", "malware": "Venus Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "1b553d0deee36318fac4ea8a7822bb11", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "f8d417955360e608ed22d94ae7c26ba9627a2d2c", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "52af906ca0e69f2be68ff7393f929b89d42c9d578a8481d962241fb8ac9d319c", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "6d0beeac9ae574a69a6aabc77a34fa55", "type": "md5_hash", "threat": "payload", "malware": "Venus Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "40ac141999c5806f51f3d9d08eb043d472003130", "type": "sha1_hash", "threat": "payload", "malware": "Venus Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "a2cb8a9398e88f4b81dd24a02cd2302aed3cacf5", "type": "sha1_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "9c6d2bd1beaac1d7e0f67c8680d11df7", "type": "md5_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "99102a573990e3096da0f373f264104207ff8c2f8d5172cd4e7a779dc4936f2b", "type": "sha256_hash", "threat": "payload", "malware": "Venus Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "672d0f08ac533cffd47c6905356ba895f0ba3f0c", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "13aae5a1849fdf61d2eec3de6f0fb87a", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "7c2c2e9b864f38e2b915cb87250f51b2a88b95b3a8737fd9588107da125e9b7e", "type": "sha256_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "edefd8b9348792b19497ff0d9cdeec5d9283d95b3fe70193ae908770c6aed180", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "08db6ec2b40397b84c8e768d3736a2fc", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "cee2aa4fb426fe7d878d79089d67a239eae9e560", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "cfb1c049fa08ed9b5df3c7a0f8d40ed0737d16e305b2236d4eb3e0a16f709a87", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "e1bc0dbd7f1c8af8fb8fb5c235b66e1a", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "0fd46c5e4133ede163a249a61708a6bdd4010352", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "6b2a818393030f029ab112b754ddc1b35616354fe75f48b705e6fe6552d3b2d0", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "0e5e6d03bf59d4f929b6585e2d284d84d448b946ebe28a0ba6f21d81a25c0bca", "type": "sha256_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "2ef352398ec899b418746a002f51fb16ebfc6fe3", "type": "sha1_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "7ecfb111f55371639acb3d0bcdd20e01", "type": "md5_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "b70eb34572103dc30edefc1879909016eba91a56", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "1281b5aa895a3b5d205b813009eaf85a", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "e8c4ac6ff2aa1bebaa07311ba9d6d993d49966daf5b050bf3e911fe926a4f251", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "30161f3b7d0ce2c86522cec3a4e97ea2b2a8065eddddfda258d80606da3af449", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "418cd33cb59a5d46af7e9b29c2451fecea1fd414", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "15bff04d1b12e6e5a41a2518c6263858", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "fc84ea86574c7ba49fd45a223f667905bf7d0cf201b35848c50078b061722747", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "a6e6853ab0e697bfb5dc6a09922c99bf42e027e5", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "2560d47ff5e3490c30a79a3c15c6742e", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "b60a7b4db2a9360461c3e3a30dc4c4e63dc77f09", "type": "sha1_hash", "threat": "payload", "malware": "Ghost RAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "8ee0ce41863e81229521e81b2bec2c59d1a8dbd471629d225cf1c5d2abf71ed6", "type": "sha256_hash", "threat": "payload", "malware": "Ghost RAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "2f96f830b3b01ee31ab78d909ae2f718", "type": "md5_hash", "threat": "payload", "malware": "Ghost RAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "c1a4a7448bc3f868e624311621535ce1", "type": "md5_hash", "threat": "payload", "malware": "ValleyRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "2435a5f04a4ffc3f3ed7c065c44d5d254084f46f", "type": "sha1_hash", "threat": "payload", "malware": "ValleyRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "e0cb38109715476c5db9be2fc7fb4611b93e037467b0b3c56872537b623d5ccf", "type": "sha256_hash", "threat": "payload", "malware": "ValleyRAT", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "5bc927fab5cbfc7b142e43c5c7bcb14e", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "25e620f12932c7fbc5d18eb4b42014a2513478d8", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "a2fc9f4f55eef0e3bbf135ca9cbd7c22b697dd834c99951591b86c79bdaab924", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-14 15:11", "source": "ThreatFox" }, { "ioc": "e.appel4d.com", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 15:05", "source": "ThreatFox" }, { "ioc": "https://raw.githubusercontent.com/Andysalt2314/ftop/refs/heads/main/antivibratory/Hosted-Desktop-Self-Ghostfolio-Dashboard-v1.0.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 15:03", "source": "URLhaus" }, { "ioc": "www.olip-international.at", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 15:01", "source": "ThreatFox" }, { "ioc": "https://raw.githubusercontent.com/akbar-ops/inertia/refs/heads/main/backend/apps/core/services/ollama_agent/sistema_de_analisis_documentos_juridicos_v3.9.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 14:52", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/akbar-ops/inertia/refs/heads/main/backend/de_juridicos_sistema_analisis_documentos_v2.9-alpha.5.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 14:52", "source": "URLhaus" }, { "ioc": "https://github.com/Pyramidriseize/ai-fursuit-pattern-generator/releases/download/v0.1.2/ai-fursuit-pattern-generator.zip", "type": "url", "threat": "malware_download", "malware": "github, MopsStealer", "confidence": 100, "first_seen": "2026-11-14 14:50", "source": "URLhaus" }, { "ioc": "https://github.com/Obsidiantatrap/wow-forever-builds-waymark/releases/download/v1.0.5/wow-forever-builds-waymark.zip", "type": "url", "threat": "malware_download", "malware": "github, MopsStealer", "confidence": 100, "first_seen": "2026-11-14 14:50", "source": "URLhaus" }, { "ioc": "http://220.198.112.93:42447/i", "type": "url", "threat": "malware_download", "malware": "cowrie, elf, honeypot, mipsel, Mozi", "confidence": 100, "first_seen": "2026-11-14 14:44", "source": "URLhaus" }, { "ioc": "04a6c4f691286d4c6c6ed280a484931d1cede33b91d0c3611cb4b2ac1928e99f", "type": "sha256_hash", "threat": "payload", "malware": "AMOS", "confidence": 100, "first_seen": "2026-11-14 14:25", "source": "ThreatFox" }, { "ioc": "boost-19.com", "type": "domain", "threat": "payload_delivery", "malware": "AMOS", "confidence": 100, "first_seen": "2026-11-14 14:25", "source": "ThreatFox" }, { "ioc": "https://boost-19.com/curl/irdxh38dlz/r9yq8jgse57g57oi190.dat", "type": "url", "threat": "payload_delivery", "malware": "AMOS", "confidence": 100, "first_seen": "2026-11-14 14:25", "source": "ThreatFox" }, { "ioc": "http://125.46.199.224:55599/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 14:22", "source": "URLhaus" }, { "ioc": "https://github.com/DiplomatHearth/roblox-ai-place-diff/releases/download/v1.5.10/roblox-ai-place-diff.zip", "type": "url", "threat": "malware_download", "malware": "github, MopsStealer", "confidence": 100, "first_seen": "2026-11-14 14:18", "source": "URLhaus" }, { "ioc": "http://119.117.88.50:48728/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 14:17", "source": "URLhaus" }, { "ioc": "c.geng7.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 14:10", "source": "ThreatFox" }, { "ioc": "https://cdn.discordapp.com/attachments/1567313157385363520/1571209788115910826/3663f110c1?ex=6af9e6a5&is=6af89525&hm=367cbf222cdc97ed40a186175a38d5f973a4af923deb1696066c434ac5a3778c&", "type": "url", "threat": "malware_download", "malware": "IRAHook", "confidence": 100, "first_seen": "2026-11-14 14:10", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/PitAeromancerTent78/zaPret_YOUtUbE-gitHUB/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/lastdeputyponder/AdgUaRD-vpN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/mixedverseadze/my-rEMnawave/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/marblesleuthsupply/PRotON-vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Middletistore/zAPRet_YoUTubE-dIsCOrD_GitHuB-1.9.9C/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Varnishuiswell/tELegraM_proxy/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/middlebladesmanstore/MY-rEmNAWAVE/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/stringrhinopier/ADGUArD-vPn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Urbanbrofigure/TelEgRAm_ZapRet_1.9.9C/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Varnishuiswell/vPN-telEGRam/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/sortstorkdevastate/aDgUArD-VpN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Whitechuchain/teLegRamZAPrEt/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/lastdeputyponder/WINDoW-vPn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Secretduspell/zapREt-yOuTuBe-diScOrd-GItHub-1.9.9c/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/DesertPotterAngular/TeLeGrAmzAPReT/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/ZenRobinStay/zapret-DisCORd_YoUtUBE/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/PitAeromancerTent78/ZapREt-YOUtubE-fIx/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Secretduspell/TElEGraM_zAPRet_1.9.9C/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/stringrhinopier/FrEE_vPn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Secretduspell/zaprEt_TElegrAm_1.9.9C/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Middletistore/zAPrettelegRAm/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/stringrhinopier/protoN-vPN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Secretduspell/ZapReT-DiScORd_yOUTUbe-1.9.9C/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Varnishuiswell/tElegrAM_PReMiUM/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/mistlocustroad/wiNdoW-vPn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/stringrhinopier/wIndow_VPN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/upgradebladehovel/vPnBOt/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/ZenRobinStay/telegRamZAPret/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Varnishuiswell/TelegRam-zapret/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/DesertPotterAngular/zAPRet-YOUtuBE-GiTHUb/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Urbanbrofigure/zaprEt-YoutuBe-DIscord-GithuB-1.9.9C/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Middletistore/TeLegRAm-zapRET-1.9.9C/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:06", "source": "URLhaus" }, { "ioc": "l5.appel4d.com", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "ThreatFox" }, { "ioc": "http://182.115.72.70:39949/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/sortstorkdevastate/window-vPn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/marblesleuthsupply/aDGuard-VpN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/sortstorkdevastate/plAnEt_VPN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/mistlocustroad/fREE_VPn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/ZenRobinStay/ZApRET_YOuTubE-giTHUB/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/mistlocustroad/adguArd-vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Whitechuchain/zapret-dIscORD-yOUTUBe/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Urbanbrofigure/ZAprET_dISCorD-YOUTuBE-1.9.9C/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/marblesleuthsupply/WindOW-vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/ShatterFiscalStuff/TeLEgRaM-pReMIum/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/upgradebladehovel/my-ReMNaWAve/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/sortstorkdevastate/prOTOn_vPn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/CableGunsmithHope/Vpn-teLEgrAm/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/DesertPotterAngular/zAPRET-yoUTUbE_fIX/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/ZenRobinStay/ZaPrEt-yOUTuBe-diScORD-gIthUb/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/ShatterFiscalStuff/tELegramdESkTOP/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/DesertPotterAngular/ZApREt-discoRD-yOutUbE/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/ZenRobinStay/ZAPret-YOuTubE_FiX/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/marblesleuthsupply/freE_VpN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Middletistore/ZapreT-DIsCoRd-yOuTUbE-1.9.9c/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/aa814678389-del/MirrorAct/refs/heads/main/experiencer/v3.8.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/lastdeputyponder/Planet-VpN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/mistlocustroad/pROToN-Vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/mixedverseadze/VpNboT/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/sortstorkdevastate/FrEE-Vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/TrueVisionSilo42/ZAPReT_DIScORD/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "http://219.155.29.131:52689/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Urbanbrofigure/zAPrET-tElEgRam_1.9.9C/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/marblesleuthsupply/PlANET-VpN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/ShatterFiscalStuff/tELeGram-zaPreT/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/lastdeputyponder/FrEE-Vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/DesertPotterAngular/zAprET-YOuTUBE-dIscord-githUB/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/middlebladesmanstore/VpnbOT/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/ShatterFiscalStuff/TELegRAM-PrOXy/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Urbanbrofigure/zAPrEtTeleGram/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/noonpythoncast59/aDguARD_vPN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Secretduspell/zAPrETtELeGrAm/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/mistlocustroad/plAnET_VpN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/stringrhinopier/PlANet_VPn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 14:05", "source": "URLhaus" }, { "ioc": "pdfdocumentsharepoint.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-14 14:01", "source": "ThreatFox" }, { "ioc": "f736f7457ddf4ba1f4ad083dd88f3f2e0dae29d69f7fe381b4ee07c7f1890639", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 13:58", "source": "ThreatFox" }, { "ioc": "https://raw.githubusercontent.com/Solarluchateau68/dISCord-zApReT_1.9.9c/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:53", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/CableGunsmithHope/TelEgRAm-PRoXY/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/conquerorworkersun/PRoTON_VpN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/conquerorworkersun/FREE_VPn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/inertiaowlbang/wiNdOW-vpN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/viewchiefrectify/TelegRam_pREmium/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/hearthaulerencoder/ADgUaRD_vPN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/fastshaperdenote/zApReT-yoUTuBe-fIX/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/CableGunsmithHope/teleGRAM-zAPRET/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/emberpharaohassess/FReE_VpN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/fixlizardclient/fRee-vPN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/flamesleuthinferno/ZapreTteleGRAm/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/fastshaperdenote/zAprET-YoUtube-GitHUB/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/flamesleuthinferno/TelEGraM_ZaPret_1.9.9C/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/inertiaowlbang/pLaNeT-vpN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/CableGunsmithHope/TeLeGRAMdESkToP/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/TrueVisionSilo42/diScoRD-zapRet-1.9.9c/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/TrueVisionSilo42/ZaprEtDiSCord/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/viewchiefrectify/teLeGRAm-proXy/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/hearthaulerencoder/prOTON-vpN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/infernalhorseday/fReE-vPN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/harmoniccockatoosouk/aDGUARd-VPN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/hunterdomainclimb/prOToN-VpN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:50", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/inertiaowlbang/AdGuARD-vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/flamesleuthinferno/ZAPRET-DisCord-yOUtube-1.9.9c/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/CableGunsmithHope/tElEgrAm_PreMiUm/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/hearthaulerencoder/frEE-VPn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/infernalhorseday/plAneT_VPN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Solarluchateau68/zApreT-dIScoRD/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/emberpharaohassess/WiNDow_vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/infernalhorseday/AdgUArD-vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/TrueVisionSilo42/DisCorDZAPrEt/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/flamesleuthinferno/ZapreT-TElEGrAm_1.9.9C/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/fixlizardclient/pRoton-VPN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/freeassurancecram/Vpn-tELeGRaM/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/hunterdomainclimb/FREE_Vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/emberpharaohassess/pLaNet-Vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/PolishCodeInflate/ZaPrET-GiThUB-dIsCord-1.9.9c/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/TrueVisionSilo42/ZAprET-GIthub-DIScord-1.9.9c/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/PolishCodeInflate/DiSCOrD-ZapRet-1.9.9C/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/viewchiefrectify/telegrAM_zaPRet/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/conquerorworkersun/WIndoW-VPn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/hunterdomainclimb/planet-vPN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/fixlizardclient/WiNdOW_Vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/emberpharaohassess/adGuArD-vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/emberpharaohassess/prOTON-VPN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/fixlizardclient/adGuARd-VpN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/hearthaulerencoder/WiNdOw-vPn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/harmoniccockatoosouk/Free-vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/viewchiefrectify/tELEgramDeSktOp/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/hunterdomainclimb/wiNdoW_vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/harmoniccockatoosouk/winDow-VPN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/fastshaperdenote/zaPrEt-YouTuBE-DiscOrd-gitHUb/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/inertiaowlbang/pROToN_Vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/flamesleuthinferno/ZapreT-yOuTubE-DIsCord-gITHUB-1.9.9c/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/decismithtempo/AdgUaRD-Vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/PolishCodeInflate/ZApReTdIsCOrd/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/harmoniccockatoosouk/PlaNeT-vPn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/fixlizardclient/PLanet-VPn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/PolishCodeInflate/dIscoRdZaPrEt/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/hearthaulerencoder/pLAnET-vPn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Solarluchateau68/disCOrDZaPrET/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Solarluchateau68/ZapRET-gIThUb-dIscorD-1.9.9c/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/harmoniccockatoosouk/PROTOn-vpN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/infernalhorseday/WIndoW-Vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/inertiaowlbang/FReE_Vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/hunterdomainclimb/aDgUARD-vpn/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/viewchiefrectify/vPn-TEleGrAM/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/infernalhorseday/PROtON-vPN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/fastshaperdenote/tELEGrAmZaPREt/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Solarluchateau68/zaPreTdiSCORd/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/fastshaperdenote/ZaPrEt-diScord-youTubE/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/PolishCodeInflate/zaprEt-dIScorD/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/conquerorworkersun/AdGUArD_VPN/refs/heads/main/serivce.bat", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer, zapret", "confidence": 100, "first_seen": "2026-11-14 13:49", "source": "URLhaus" }, { "ioc": "http://119.117.88.50:48728/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 13:47", "source": "URLhaus" }, { "ioc": "http://141.0.143.61:37884/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 13:47", "source": "URLhaus" }, { "ioc": "http://219.155.29.131:52689/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 13:32", "source": "URLhaus" }, { "ioc": "http://182.115.72.70:39949/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 13:32", "source": "URLhaus" }, { "ioc": "http://119.4.55.146:41695/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 13:32", "source": "URLhaus" }, { "ioc": "http://clouven.click:8527/tokens", "type": "url", "threat": "botnet_cc", "malware": "Remus", "confidence": 75, "first_seen": "2026-11-14 13:31", "source": "ThreatFox" }, { "ioc": "dpctech.net", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 13:22", "source": "ThreatFox" }, { "ioc": "https://thewildandfreecafe.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&t=fish.docs", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-14 13:15", "source": "ThreatFox" }, { "ioc": "https://fishofwalton-doc-access.s3.us-east-2.amazonaws.com/Index1.html", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-14 13:15", "source": "ThreatFox" }, { "ioc": "https://thewildandfreecafe.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&t=wesley.docs", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-14 13:15", "source": "ThreatFox" }, { "ioc": "z8t.appel4d.com", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 13:05", "source": "ThreatFox" }, { "ioc": "http://171.117.146.29:56014/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 13:02", "source": "URLhaus" }, { "ioc": "http://171.38.192.67:51064/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 12:51", "source": "URLhaus" }, { "ioc": "8.162.11.200:10856", "type": "ip:port", "threat": "botnet_cc", "malware": "NjRAT", "confidence": 100, "first_seen": "2026-11-14 12:50", "source": "ThreatFox" }, { "ioc": "197.206.148.126:999", "type": "ip:port", "threat": "botnet_cc", "malware": "NjRAT", "confidence": 100, "first_seen": "2026-11-14 12:50", "source": "ThreatFox" }, { "ioc": "http://27.153.233.240:44911/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 12:47", "source": "URLhaus" }, { "ioc": "nibol.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-14 12:43", "source": "ThreatFox" }, { "ioc": "http://mowcangler.co.uk:8040/Bin/ScreenConnect.ClientSetup.msi", "type": "url", "threat": "malware_download", "malware": "cm5000, connectwise, quickhost, rat, screenconnect", "confidence": 100, "first_seen": "2026-11-14 12:43", "source": "URLhaus" }, { "ioc": "http://171.38.192.67:51064/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 12:43", "source": "URLhaus" }, { "ioc": "mystore-assets-wordpress.integrationsnetz.de", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 12:41", "source": "ThreatFox" }, { "ioc": "microsoftoffice365.macrosoft.ch", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 12:40", "source": "ThreatFox" }, { "ioc": "http://105.184.100.241:39677/i", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-14 12:39", "source": "URLhaus" }, { "ioc": "https://167-148-195-171.sslip.io/e/ext.crx", "type": "url", "threat": "malware_download", "malware": "chrome, extension", "confidence": 100, "first_seen": "2026-11-14 12:37", "source": "URLhaus" }, { "ioc": "https://167-148-195-171.sslip.io/r.php?t=melbtffhjg", "type": "url", "threat": "malware_download", "malware": "chrome, ClickFix, extension", "confidence": 100, "first_seen": "2026-11-14 12:37", "source": "URLhaus" }, { "ioc": "http://115.50.93.129:33005/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 12:32", "source": "URLhaus" }, { "ioc": "38.60.205.67:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-14 12:26", "source": "ThreatFox" }, { "ioc": "38.60.206.178:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-14 12:26", "source": "ThreatFox" }, { "ioc": "https://pakdigital.org/gf/mZ", "type": "url", "threat": "malware_download", "malware": "ascii, Encoded", "confidence": 100, "first_seen": "2026-11-14 12:22", "source": "URLhaus" }, { "ioc": "https://metaslate.org/uBF7J3Oasiut/pE7rAq5Rz02L.php", "type": "url", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 12:21", "source": "ThreatFox" }, { "ioc": "https://pakdigital.org/gg/jE", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 12:20", "source": "URLhaus" }, { "ioc": "https://kekman.space/verify.exe", "type": "url", "threat": "malware_download", "malware": "ClickFix, win, xworm", "confidence": 100, "first_seen": "2026-11-14 12:20", "source": "URLhaus" }, { "ioc": "130.94.13.23:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-14 12:19", "source": "ThreatFox" }, { "ioc": "130.94.10.21:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-14 12:19", "source": "ThreatFox" }, { "ioc": "pcsofthub.cfd", "type": "domain", "threat": "payload_delivery", "malware": "Remus", "confidence": 85, "first_seen": "2026-11-14 12:18", "source": "ThreatFox" }, { "ioc": "67.215.228.4:25774", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-14 12:18", "source": "ThreatFox" }, { "ioc": "tz.5671234.xyz", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-14 12:18", "source": "ThreatFox" }, { "ioc": "h99.anka69.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 12:15", "source": "ThreatFox" }, { "ioc": "appel4d.com", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 12:05", "source": "ThreatFox" }, { "ioc": "kc.appel4d.com", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 12:05", "source": "ThreatFox" }, { "ioc": "jk.apaljitu.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 12:05", "source": "ThreatFox" }, { "ioc": "http://105.184.100.241:39677/bin.sh", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-14 12:04", "source": "URLhaus" }, { "ioc": "http://42.238.173.210:60773/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 12:02", "source": "URLhaus" }, { "ioc": "http://42.224.97.139:42197/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 12:02", "source": "URLhaus" }, { "ioc": "f61e9548ea915f7d052b1b929bb5ddf597a3fd93ee208b14b0e03553b98f7583", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-14 11:58", "source": "ThreatFox" }, { "ioc": "s7lgx4no.rochi.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-14 11:56", "source": "ThreatFox" }, { "ioc": "http://42.238.173.210:60773/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 11:47", "source": "URLhaus" }, { "ioc": "http://105.187.46.127:46697/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 11:47", "source": "URLhaus" }, { "ioc": "http://115.58.88.213:34011/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 11:47", "source": "URLhaus" }, { "ioc": "http://125.25.188.237:44712/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 11:47", "source": "URLhaus" }, { "ioc": "rochi.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-14 11:35", "source": "ThreatFox" }, { "ioc": "mutel.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-14 11:32", "source": "ThreatFox" }, { "ioc": "http://113.128.236.213:32993/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 11:32", "source": "URLhaus" }, { "ioc": "http://125.25.188.237:44712/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 11:17", "source": "URLhaus" }, { "ioc": "zs.apij4ya.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 11:05", "source": "ThreatFox" }, { "ioc": "y.geng7.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 11:05", "source": "ThreatFox" }, { "ioc": "https://github.com/Tropicaldrescoop/discord-id-osint-checker/releases/download/v1.0.2/discord-id-osint-checker.zip", "type": "url", "threat": "malware_download", "malware": "github, MopsStealer", "confidence": 100, "first_seen": "2026-11-14 11:04", "source": "URLhaus" }, { "ioc": "3c998ffdd5648bb4072e96387897ab89455b02aabf5ea73494fe555f9f685014", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "6cb8c7e7939ba382e88edd6f4405c9e17f0bb66d719982f4278a4e25c30c0e47", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "7011d646f56e2fa8f72e66a87ffc20d4e9e610721a82b366ddce96aaea51ebf7", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "b25e2635e6f6e2e101e52d68034a728823e54526b63564a40c6c5e5070d886b2", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "e55e217c797e4123d4411735492f87e27b9ed064287cd2df070eae2017084cac", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "6c6eaeb86293a75b1a28255e4426c08895d57bc15e4450e1b7d5022e7e973912", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "6e3c3a20328956eb3d80f9e752c5873aaba73a6815e3ed92294159cd5b9e8dd6", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "4982ff0b373b7d32ab73ea313210d9033321de4bc86e0849ed70d0de7f24f506", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "2bc71ed33460f47baffa7435270d55b708cc1c03fae0a665f2767f399541e586", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "35e74b9cb37c62bca72ee517f0535c824a7bdc316d770ce2d7a121e15b6230c6", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "1bcef3819795dff508adfac141f05a1b38a30e726b8f3c08949e47aa5186d55c", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "b568d06782e6cc17ed3155a674060e4cddd2faa362287be6ebc7f883c0056ebe", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "f45307f30635835b2d7a5fa413bce30c450743f89548fe01ddb95f7d8a1cd5b4", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "9cca42dbad84fb6faff04f979b2e2c6bade31287698b61ebd149403ec5be4421", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "dc162de9ac4017bb63717c3f0b1c506f5b920934169e60a2fb9bbd110307e52e", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "1632d17336a9071563699e73923c88a4f5b9572fc8332492d89aa7fb25bb6a57", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "ebab8149935920098d7e0d5c148177078c653c79ec6de4132aefd981f005cb3c", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "de2d84ee1f77e6d86e1d072d446a833d35c878ac217d44a4adac9bd850b1c125", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "a48813fa517be4919a0efd0b72c6478bf211e0f2dc36487f01c6c4bad7f5bc01", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "e1d417445232ec04b634b32f21fd50f512f5235eafc0c742cbbee091a6d2e0d5", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "efbc1158dcc60c47a133fe57af2759b202dcd1904a44221e4937efeb6fab715a", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "7273ae236b007635b0dbc20ef0bee2a43efbd900b52964272d278f6094a3530e", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:59", "source": "ThreatFox" }, { "ioc": "ac33aeac1d4d741403e4a3cf3f0d35a2d813d8d9c7beba7133ec9ed3b0344800", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:58", "source": "ThreatFox" }, { "ioc": "e4fed82ac5ee820db1393044746f55324aab1cbce858324d9da7a3698795f5e5", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:58", "source": "ThreatFox" }, { "ioc": "a571dd15feb300d046f7f9505fb30197acc4904ac4a37cdf016b384593c86a7c", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:58", "source": "ThreatFox" }, { "ioc": "159aaa8e104f42d0445c9d184bbd2f946c4518515d4ee4ef3fc90a9a7c023f20", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:58", "source": "ThreatFox" }, { "ioc": "35f2e4233ec423db7204af2998143c68a5faf47b9ecbe12601e4d38603b4fa31", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:58", "source": "ThreatFox" }, { "ioc": "e206ce378787981efa46bf99fa91f229cd5fabd3210e6cdfe1590c48182ac179", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:58", "source": "ThreatFox" }, { "ioc": "d650bab654028c4fd16b1eba2d6691710021ccfb553b6505109c3351b340a7bf", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:58", "source": "ThreatFox" }, { "ioc": "19d52aef11f437ca6fb3905141ee6faf8b19bd344d259b36dce10ffbb443c759", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:58", "source": "ThreatFox" }, { "ioc": "eee65a543615e429054763deef9143befa25499ba4bf313bcac4e544ba495142", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:58", "source": "ThreatFox" }, { "ioc": "cb6b149aacaadb53ff64a0cefc09a14cecc7e37355f95c13182a8879857d6cf8", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:58", "source": "ThreatFox" }, { "ioc": "8903cc1a1711040216e165d43603f4aeb1551d9c590ee792d797d1083e1ff1a3", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:58", "source": "ThreatFox" }, { "ioc": "6378a4efe2174e1a187440440a29b66fe1411c4c93e329ff2e357a9efdc3dbf5", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:58", "source": "ThreatFox" }, { "ioc": "5c9a1663d9354ef92b58614119aff3f11d969783be0df660b710330d0e7930e9", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 10:58", "source": "ThreatFox" }, { "ioc": "http://36.77.226.233:60190/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 10:32", "source": "URLhaus" }, { "ioc": "http://182.127.128.166:56957/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 10:32", "source": "URLhaus" }, { "ioc": "http://182.121.254.245:48296/i", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-14 10:14", "source": "URLhaus" }, { "ioc": "sc.apij4ya.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 10:05", "source": "ThreatFox" }, { "ioc": "5.188.86.227:7443", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 10:05", "source": "ThreatFox" }, { "ioc": "47.238.116.190:8011", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 10:05", "source": "ThreatFox" }, { "ioc": "129.211.183.201:8080", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 10:05", "source": "ThreatFox" }, { "ioc": "http://182.121.254.245:48296/bin.sh", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-14 09:46", "source": "URLhaus" }, { "ioc": "https://flycheats.xyz/Yeni%20klas%C3%B6r/zerocheat.exe", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 09:44", "source": "URLhaus" }, { "ioc": "http://103.172.186.137:50916/bin.sh", "type": "url", "threat": "malware_download", "malware": "arm, cowrie, elf, honeypot, Mozi", "confidence": 100, "first_seen": "2026-11-14 09:44", "source": "URLhaus" }, { "ioc": "https://1wvfp73huh.ufs.sh/f/TpFkH170dzixiTubFjW5B7Tn9osHF03JWA4buircKM6qdYS8", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 09:44", "source": "URLhaus" }, { "ioc": "161.248.179.27:8080", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-14 09:40", "source": "ThreatFox" }, { "ioc": "http://125.43.103.214:43807/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 09:32", "source": "URLhaus" }, { "ioc": "http://94.255.129.5:54253/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-14 09:19", "source": "ThreatFox" }, { "ioc": "https://github.com/YoctoRoninClip/v2raytun-x64/releases/download/v1.0/v2raytun_windows.zip", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer", "confidence": 100, "first_seen": "2026-11-14 09:17", "source": "URLhaus" }, { "ioc": "https://github.com/Southonanchorage/v2raytun-x64/releases/download/v1.0/v2raytun_windows.zip", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer", "confidence": 100, "first_seen": "2026-11-14 09:17", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Marinadudepict/v2raytun-x64/refs/heads/main/v2raytun_windows.zip", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer", "confidence": 100, "first_seen": "2026-11-14 09:16", "source": "URLhaus" }, { "ioc": "https://github.com/Marinadudepict/v2raytun-x64/releases/download/v1.0/v2raytun_windows.zip", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer", "confidence": 100, "first_seen": "2026-11-14 09:16", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/YoctoRoninClip/v2raytun-x64/refs/heads/main/v2raytun_windows.zip", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer", "confidence": 100, "first_seen": "2026-11-14 09:16", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Southonanchorage/v2raytun-x64/refs/heads/main/v2raytun_windows.zip", "type": "url", "threat": "malware_download", "malware": "github, SalatStealer", "confidence": 100, "first_seen": "2026-11-14 09:16", "source": "URLhaus" }, { "ioc": "https://github.com/misnopini1987/GTA-5-Trainer-Menu-Base/releases/download/v1.0.0/build_2026-11-13.zip", "type": "url", "threat": "malware_download", "malware": "github, Stealc", "confidence": 100, "first_seen": "2026-11-14 09:16", "source": "URLhaus" }, { "ioc": "https://cdn.discordapp.com/attachments/1571133374657990727/1571135485638615070/eea95d6aff?ex=6af9a172&is=6af84ff2&hm=a0d4d77cda4c48032028bf9a07e86b4541ed1130d42378736050e435f5b893d4&", "type": "url", "threat": "malware_download", "malware": "IRAHook", "confidence": 100, "first_seen": "2026-11-14 09:14", "source": "URLhaus" }, { "ioc": "fg.apij4ya.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 09:05", "source": "ThreatFox" }, { "ioc": "http://222.142.252.54:40470/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 08:32", "source": "URLhaus" }, { "ioc": "http://119.99.166.64:33426/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 08:24", "source": "URLhaus" }, { "ioc": "http://103.203.210.102:57006/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 08:17", "source": "URLhaus" }, { "ioc": "e.geng7.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 08:10", "source": "ThreatFox" }, { "ioc": "bo.apij4ya.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 08:05", "source": "ThreatFox" }, { "ioc": "p3l.apaljitu.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 08:05", "source": "ThreatFox" }, { "ioc": "apaljitu.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 08:05", "source": "ThreatFox" }, { "ioc": "23.227.196.115:8080", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 100, "first_seen": "2026-11-14 08:05", "source": "ThreatFox" }, { "ioc": "23.227.196.115:80", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 100, "first_seen": "2026-11-14 08:05", "source": "ThreatFox" }, { "ioc": "16.170.157.239:80", "type": "ip:port", "threat": "botnet_cc", "malware": "AsyncRAT", "confidence": 100, "first_seen": "2026-11-14 08:05", "source": "ThreatFox" }, { "ioc": "23.227.196.115:443", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 100, "first_seen": "2026-11-14 08:05", "source": "ThreatFox" }, { "ioc": "http://60.187.87.254:41025/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 08:02", "source": "URLhaus" }, { "ioc": "http://27.8.115.76:43017/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 08:02", "source": "URLhaus" }, { "ioc": "http://27.44.144.152:47094/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 08:02", "source": "URLhaus" }, { "ioc": "http://182.233.3.133:42726/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 08:01", "source": "URLhaus" }, { "ioc": "http://222.138.183.92:51987/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 07:47", "source": "URLhaus" }, { "ioc": "http://61.54.43.182:46469/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 07:47", "source": "URLhaus" }, { "ioc": "337u6zp1.retica.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-14 07:43", "source": "ThreatFox" }, { "ioc": "http://42.237.48.144:53651/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 07:32", "source": "URLhaus" }, { "ioc": "http://117.40.68.182:40683/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 07:32", "source": "URLhaus" }, { "ioc": "http://27.8.115.76:43017/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 07:32", "source": "URLhaus" }, { "ioc": "http://42.224.97.139:42197/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 07:32", "source": "URLhaus" }, { "ioc": "http://112.232.224.88:41588/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 07:32", "source": "URLhaus" }, { "ioc": "http://61.54.43.182:46469/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 07:31", "source": "URLhaus" }, { "ioc": "https://github.com/Abdoulaadim/API-c-/raw/refs/heads/master/teleplasmic/API-c-.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:31", "source": "URLhaus" }, { "ioc": "retica.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-14 07:26", "source": "ThreatFox" }, { "ioc": "mosal.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-14 07:22", "source": "ThreatFox" }, { "ioc": "https://github.com/Abdoulaadim/API_GIThub/raw/refs/heads/master/GIF/AP-GI-Thub-1.3.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/dao_architecture_java/refs/heads/master/preconcertion/dao_architecture_java.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Hospital/refs/heads/master/uninflammable/Hospital.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Client-Panel-Firebase-authentification-/refs/heads/master/almsfolk/Client-Panel-Firebase-authentification-.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/codingzone/refs/heads/master/Rhipidistia/codingzone.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/html-css-maquettage/refs/heads/master/expostulatively/html-css-maquettage.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/academieBackend/refs/heads/master/misfare/academieBackend.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://github.com/Abdoulaadim/Airoport-sql-server-/raw/refs/heads/master/acroama/Airoport-server-sql-v3.5.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Bcskls/refs/heads/master/Trilophodon/Bcskls.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/API_GIThub/refs/heads/master/rotula/API_GIThub.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Fiches-techniques-automobile/refs/heads/master/verifiability/Fiches-techniques-automobile.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/LINQ-C-/refs/heads/master/dipterocarp/LINQ-C-.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Airoport-sql-server-/refs/heads/master/acroama/Airoport-sql-server-.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/add_element_js/refs/heads/master/cremationist/add_element_js.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/ARRADESS/refs/heads/master/moity/ARRADESS.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/LINQ-C-/refs/heads/master/Linq_Partie_1/bin/Debug/LIN-v2.5.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Contacts-App-Firebase/refs/heads/master/auncel/Contacts-App-Firebase.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Fondamentaux-de-Typescript/refs/heads/master/typescript/.vs/Typescript_de_Fondamentaux_v1.7-beta.5.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/mutelle_javafx/refs/heads/master/overtype/mutelle_javafx.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/BAMCOREPORT4-4-Security-SpringBoot/refs/heads/master/backchat/BAMCOREPORT4-4-Security-SpringBoot.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Hospital/refs/heads/master/hospitals/bin/com/hospital/interfaces/Software_v1.4-alpha.3.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Maquettage/refs/heads/master/contentless/Maquettage.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/acdemieFrontEnd/refs/heads/master/pinacocyte/acdemieFrontEnd.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Fiches-techniques-automobile/refs/heads/master/fiche-technique/techniques-Fiches-automobile-v3.6.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/location-v-hicule-html-css-javascript-/refs/heads/master/inexistent/location-v-hicule-html-css-javascript-.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/mutelle_javafx/refs/heads/master/mutuelle/src/application/mutelle-javafx-2.9.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/gestion-stock/refs/heads/master/annectent/gestion-stock.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Fondamentaux-de-Typescript/refs/heads/master/Grimmiaceae/Fondamentaux-de-Typescript.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/calculatrice-js/refs/heads/master/undrooping/calculatrice-js.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://github.com/Abdoulaadim/API-rest--vuejs/raw/refs/heads/master/peridiiform/rest-AP-vuejs-2.1-beta.5.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/API-rest--vuejs/refs/heads/master/peridiiform/API-rest--vuejs.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/BAMCOREPORT4-4-Security-SpringBoot/refs/heads/master/bamcoreport4-4security/.mvn/Spring-BAMCOREPOR-Security-Boot-2.5-alpha.1.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/CICD-BAMCOREPORT4/refs/heads/master/highhearted/CICD-BAMCOREPORT4.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/html-css-maquettage/refs/heads/master/bref%202%20html%20%26%26css%26%26maquettage/bref%201%20html/memorial/html-maquettage-css-3.0.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:15", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Client-Panel-Firebase-authentification-/refs/heads/master/Clinet%20Panel/src/app/models/authentification_Client_Panel_Firebase_v2.9.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:06", "source": "URLhaus" }, { "ioc": "hl.apij4ya.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "ThreatFox" }, { "ioc": "112.124.108.207:8084", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "ThreatFox" }, { "ioc": "129.211.183.201:18083", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "ThreatFox" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Bcskls/refs/heads/master/Bcskls_/Bcskils%202/bureaudorder/resources/views/api/Software-Michel.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/calculatrice-js/master/GIF/calculatrice_js_v3.1.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/CICD-BAMCOREPORT4/refs/heads/master/bamcoreport4-4security/src/main/java/com/BAMCOREPOR_CIC_3.5.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "URLhaus" }, { "ioc": "https://github.com/Abdoulaadim/add_element_js/raw/refs/heads/master/add-element/js-element-add-v2.6.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "URLhaus" }, { "ioc": "https://github.com/Abdoulaadim/location-v-hicule-html-css-javascript-/raw/refs/heads/master/image/v-javascript-hicule-css-location-html-2.0-beta.4.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "URLhaus" }, { "ioc": "https://github.com/Abdoulaadim/acdemieFrontEnd/raw/refs/heads/master/src/app/shared/composants/acdemie_End_Front_1.4.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Forum_it_laravel/refs/heads/master/bref10_Laravel_Forum%20IT/Forum_it/Forum_it/app/Models/Forum_laravel_it_3.9-beta.4.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/gestion-stock/refs/heads/master/bref%204%20php1/uml/stock-gestion-2.6.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Contacts-App-Firebase/refs/heads/master/Angular%20Firebase%20Contact/src/app/models/Contacts-Firebase-App-2.2.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/dao_architecture_java/refs/heads/master/dao/YCBank/dao-java-architecture-1.8.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/ARRADESS/refs/heads/master/ARADESS%20Android%20Studio/Software-v1.5.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/academieBackend/refs/heads/master/src/main/java/com/example/academie/services/impl/academie_Backend_v1.9.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Forum_it_laravel/master/ceric/Forum_it_laravel.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/codingzone/refs/heads/master/codingzone/maquettage/Software-v2.5.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 07:05", "source": "URLhaus" }, { "ioc": "http://112.232.224.88:41588/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 07:02", "source": "URLhaus" }, { "ioc": "http://125.47.209.230:51959/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 07:02", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/daveyisbricked/movie-finder-react/main/compositive/movie-finder-react-v3.0.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 06:59", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/Abdoulaadim/Maquettage/refs/heads/master/contentless/Software_v3.3-beta.4.zip", "type": "url", "threat": "malware_download", "malware": "github, SmartLoader, zip", "confidence": 100, "first_seen": "2026-11-14 06:59", "source": "URLhaus" }, { "ioc": "9e4d3c1ddd607faa8813efddb0ca71ee81d7ae9a23898eb21f9b100200f2b039", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-14 06:58", "source": "ThreatFox" }, { "ioc": "23c3719c7f949d6074fd3505928116df52de0e95e18a0a9e8c966b276b08e4ee", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 06:58", "source": "ThreatFox" }, { "ioc": "http://66.205.236.89:42570/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 06:48", "source": "URLhaus" }, { "ioc": "23.158.24.136:4321", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 75, "first_seen": "2026-11-14 06:44", "source": "ThreatFox" }, { "ioc": "209.99.190.30:4322", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 75, "first_seen": "2026-11-14 06:44", "source": "ThreatFox" }, { "ioc": "195.248.240.197:8080", "type": "ip:port", "threat": "botnet_cc", "malware": "Evilginx", "confidence": 75, "first_seen": "2026-11-14 06:44", "source": "ThreatFox" }, { "ioc": "194.59.30.10:8443", "type": "ip:port", "threat": "botnet_cc", "malware": "Evilginx", "confidence": 75, "first_seen": "2026-11-14 06:44", "source": "ThreatFox" }, { "ioc": "186.244.226.17:9809", "type": "ip:port", "threat": "botnet_cc", "malware": "ValleyRAT", "confidence": 75, "first_seen": "2026-11-14 06:25", "source": "ThreatFox" }, { "ioc": "41.232.128.104:8443", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-14 06:15", "source": "ThreatFox" }, { "ioc": "lapoire10.hopto.org", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 06:15", "source": "ThreatFox" }, { "ioc": "http://85.11.167.150/bins/kla.sh", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-14 06:14", "source": "ThreatFox" }, { "ioc": "http://112.254.233.217:34052/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 06:13", "source": "URLhaus" }, { "ioc": "apij4ya.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 06:10", "source": "ThreatFox" }, { "ioc": "gq.apij4ya.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 06:10", "source": "ThreatFox" }, { "ioc": "129.211.183.201:18080", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 06:05", "source": "ThreatFox" }, { "ioc": "120.79.172.40:18083", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 06:05", "source": "ThreatFox" }, { "ioc": "120.79.172.40:22", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 06:05", "source": "ThreatFox" }, { "ioc": "120.79.172.40:18080", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 06:05", "source": "ThreatFox" }, { "ioc": "111.229.193.40:38001", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 06:05", "source": "ThreatFox" }, { "ioc": "8.148.13.187:5555", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-14 06:04", "source": "ThreatFox" }, { "ioc": "http://39.70.35.63:55505/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 06:02", "source": "URLhaus" }, { "ioc": "https://alfajrqatar.com/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-14 06:00", "source": "ThreatFox" }, { "ioc": "ezmobilewebsitetools.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-14 06:00", "source": "ThreatFox" }, { "ioc": "23d4a386f0f030bb0e9c659b238143e1bf279d424743a340b386b603fa7f899d", "type": "sha256_hash", "threat": "payload", "malware": "WARDENStealer", "confidence": 90, "first_seen": "2026-11-14 05:59", "source": "ThreatFox" }, { "ioc": "7872199f2579403f94d7b6b78ca41d9ed16e80626f3684f10ece69fff062d660", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:59", "source": "ThreatFox" }, { "ioc": "a762a142c7c08f991ddffd189f0f226719c570166a72f370e486b0850f9dcc17", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:59", "source": "ThreatFox" }, { "ioc": "6c6ec81758db9f2385cc18755eaef6586a553d17ffe0a13fe338061f42925259", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:59", "source": "ThreatFox" }, { "ioc": "e5156795ff8dc357a40362cc744d5ab09666be4bb02445cdbbf8f83697c77a11", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:59", "source": "ThreatFox" }, { "ioc": "24d67e8b085a20f33e8fe491255dbcde54498cff125a701deef1319a78a005ab", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:59", "source": "ThreatFox" }, { "ioc": "e8362d288e63d8edb6d13579aec05e3eeac1c4e00ba01d511fcb26bad7b61d3f", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:59", "source": "ThreatFox" }, { "ioc": "36102789682a0e3171e68eb04cb8fdbdd93bc5942c040eb8dbc9661ba3250b47", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:59", "source": "ThreatFox" }, { "ioc": "fe419f0107b5c06e99b13f9b00ee37314a9665a7b6ba127eb0605ff81142270c", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "696adc0309b1218f89e3547d94599d78eaf28780a77463c1ddb4763a315a02c6", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "858ff0cbca65b0149a8b45f3c3207190e423c80a46affbbfe0ec6d6a32b9c425", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "323912fe9add1c43a654a013e3184335ad70270db8bbd452851b8e5a15c7c352", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "9c7eb65b1812b3a827dca8df5862b713131d012d364181d8b040d9aef8acbc67", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "98184079c818ae47201d84cd77d528807a6f58c81f5128a90a12dadba8485941", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "fce7a33cda37dba4aeade9c75f82e172dbd89a1b254cd18edd76b5dd3707bdd2", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "4dbf1b3e488c829ff3fe46d8d2a024709e7fc27f1fa43446bfc4ab8951ef0c04", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "2b3cbb277fcf8e474f0db6cbfc86faeacd7586277e696d39c14efc3ea54cacfa", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "6f49f9b2749cd13d1b8112c23480da8e0af241d9b3b9b74580a606f9aa197226", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "43191bb9ca34c5dfcf286477b64824981fe7c1681f80461df1e43d34be9b7414", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "263a22c8981b279edbffa15531c6076e3d48f7f850989e4c288db8c58e5dc8a1", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "a707615eba9b2cd86d84d5a0aeb208a8f9aa0a96bd92fa7c2a29f1d6daa44c39", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "a18aacc9377f74fafb34e0aabbe2988fdb70fb7dfc82d69b278aaa8c2ce9e7be", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "73b58d9e312a7aec2df6f9346714d3b5e611d593276427eaf07af2599f0e7e09", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "9c94c32605f8291956dbda5e2495b3e4cacdcd5f4e068fe5cdd92ff03e3f3353", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "2e8026dd15334043609a49c3c9dc60d428fadaf63e300fde69cc12933f50196f", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 05:58", "source": "ThreatFox" }, { "ioc": "https://cdn.discordapp.com/attachments/786850469518770207/1571084141410254938/a0f88ffb47?ex=6af971a0&is=6af82020&hm=c512d7473b74e2f60ed0287abc15ea7545b53fdcd69ab1313460acb6bdc5704b&", "type": "url", "threat": "malware_download", "malware": "IRAHook", "confidence": 100, "first_seen": "2026-11-14 05:52", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/ammerily66/FiveM-External-Cheat/refs/heads/main/Loader.exe", "type": "url", "threat": "malware_download", "malware": "github", "confidence": 100, "first_seen": "2026-11-14 05:51", "source": "URLhaus" }, { "ioc": "http://113.228.130.157:37166/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 05:48", "source": "URLhaus" }, { "ioc": "http://112.254.233.217:34052/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 05:47", "source": "URLhaus" }, { "ioc": "http://42.237.49.236:50876/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 05:47", "source": "URLhaus" }, { "ioc": "http://201.159.91.2:40711/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 05:47", "source": "URLhaus" }, { "ioc": "http://154.223.128.222:56590/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 05:47", "source": "URLhaus" }, { "ioc": "https://mccl.com.vn/img/payload_033329.png", "type": "url", "threat": "malware_download", "malware": "stego", "confidence": 100, "first_seen": "2026-11-14 05:45", "source": "URLhaus" }, { "ioc": "skies.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "mifnd.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "soful.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "taton.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "trhue.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "vdibe.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "viebe.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "wfave.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "vvoid.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "nejxt.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "wiqld.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "zehst.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "mavrk.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "meood.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "mgyth.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "zjero.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "zonce.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "pubre.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "rawew.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "rxise.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "shilk.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "skhin.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "hhalo.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "axpex.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "corge.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "cufbe.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "daerk.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "darry.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "edvge.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "epbic.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "eycho.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "fakde.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "fglow.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "flvux.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "fofrm.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "gbrid.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "gljow.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "iccon.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "ligne.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:34", "source": "ThreatFox" }, { "ioc": "http://27.44.144.164:49005/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 05:33", "source": "URLhaus" }, { "ioc": "http://27.37.101.36:50864/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 05:32", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/bot.aarch64", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:21", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/b3.armhf", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:21", "source": "URLhaus" }, { "ioc": "http://185.34.144.138:8888/b2.i686", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:21", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/b3.armel", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:21", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/bot.i686", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:21", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/b3.i686", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.138:8888/b2.armel", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/b3.mips64", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/b3.aarch64", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/b3.mips", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.138:8888/b2.aarch64", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.138:8888/b2.armhf", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.138:8888/b2.mips64", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.138:8888/b2.mips64el", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/bot.mips64el", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/bot.mipsel", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/bot.mips", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/bot.armel", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/b3.mipsel", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.138:8888/b2.mips", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/b3.mips64el", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/bot.mips64", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/bot.armhf", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.137:8888/b4.mips64", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://185.34.144.138:8888/b2.mipsel", "type": "url", "threat": "malware_download", "malware": "ua-wget", "confidence": 100, "first_seen": "2026-11-14 05:20", "source": "URLhaus" }, { "ioc": "http://182.114.34.235:43048/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 05:18", "source": "URLhaus" }, { "ioc": "http://119.115.216.185:33555/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 05:17", "source": "URLhaus" }, { "ioc": "154.9.251.119:10086", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 75, "first_seen": "2026-11-14 05:14", "source": "ThreatFox" }, { "ioc": "43.167.208.199:9090", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 75, "first_seen": "2026-11-14 05:14", "source": "ThreatFox" }, { "ioc": "telnets.top", "type": "domain", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 100, "first_seen": "2026-11-14 05:14", "source": "ThreatFox" }, { "ioc": "f.nkking.com", "type": "domain", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 100, "first_seen": "2026-11-14 05:12", "source": "ThreatFox" }, { "ioc": "103.89.72.90:17880", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 75, "first_seen": "2026-11-14 05:12", "source": "ThreatFox" }, { "ioc": "http://31.76.252.12/", "type": "url", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 05:07", "source": "ThreatFox" }, { "ioc": "https://megeve.beer/api/", "type": "url", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 05:07", "source": "ThreatFox" }, { "ioc": "http://82.25.63.25/f/d40f6d9e1233aa80/pkg1.zip", "type": "url", "threat": "malware_download", "malware": "zip", "confidence": 100, "first_seen": "2026-11-14 05:07", "source": "URLhaus" }, { "ioc": "http://82.25.63.25/f/d40f6d9e1233aa80/pkg2.zip", "type": "url", "threat": "malware_download", "malware": "zip", "confidence": 100, "first_seen": "2026-11-14 05:07", "source": "URLhaus" }, { "ioc": "py.apigcor88.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 05:05", "source": "ThreatFox" }, { "ioc": "geng7.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 05:05", "source": "ThreatFox" }, { "ioc": "f.geng7.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 05:05", "source": "ThreatFox" }, { "ioc": "120.79.172.40:8888", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 05:05", "source": "ThreatFox" }, { "ioc": "120.79.172.40:1080", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 05:05", "source": "ThreatFox" }, { "ioc": "120.79.172.40:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 05:05", "source": "ThreatFox" }, { "ioc": "proklyod1211.com", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 05:03", "source": "ThreatFox" }, { "ioc": "http://178.207.227.38:4073/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 05:01", "source": "URLhaus" }, { "ioc": "2431ad790c9decf8a231b36df0fc7763c35005753111d4d89913552c0b9b987a", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 90, "first_seen": "2026-11-14 04:58", "source": "ThreatFox" }, { "ioc": "http://51.158.36.212:32144/jog.png", "type": "url", "threat": "malware_download", "malware": "vnc", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "http://51.158.36.212:32144/gyy.png", "type": "url", "threat": "malware_download", "malware": "vnc", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "http://51.158.36.212:32144/exh.png", "type": "url", "threat": "malware_download", "malware": "vnc", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "http://31.76.94.111/xmrig", "type": "url", "threat": "malware_download", "malware": "crypto, docker, elf, xmr", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "http://154.9.235.100:8898/agent443", "type": "url", "threat": "malware_download", "malware": "AdaptixC2, rat", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "http://154.9.235.100:8898/agent80", "type": "url", "threat": "malware_download", "malware": "AdaptixC2, rat", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "http://31.76.94.111:8099/xmrig", "type": "url", "threat": "malware_download", "malware": "crypto, docker, elf, ssh, xmr", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "http://31.76.94.111:8099/xmrig?i=0", "type": "url", "threat": "malware_download", "malware": "crypto, docker, elf, xmr", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "http://airwayhost.com/lang/dAdy90.tgz", "type": "url", "threat": "malware_download", "malware": "botnet, c2, ELF, linux, IRCbot", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "http://43.254.30.204/k.php?a=x86_64,XJGS430D81U0TQ15H", "type": "url", "threat": "malware_download", "malware": "43-254-30-204, cowrie, elf, honeypot", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "http://31.76.94.111:8099/xmrig.gz", "type": "url", "threat": "malware_download", "malware": "crypto, docker, xmr", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "http://154.217.234.59:9100/chisel_win.exe", "type": "url", "threat": "malware_download", "malware": "chisel, hacktool", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "https://tools.lumma.cy/Br6oAs_cpwZht4JoZ_NJ.png", "type": "url", "threat": "malware_download", "malware": "BombayStealer, exe, stealer, zip", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "https://gitlab.com/triageclap/litesign/-/raw/main/stage_2.exe", "type": "url", "threat": "malware_download", "malware": "gitlab", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "https://github.com/Gray-Zone-WarfareCheats/.github/archive/refs/heads/main.zip", "type": "url", "threat": "malware_download", "malware": "github, malware", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "http://180.190.238.89:42979/Mozi.m", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "http://82.25.63.25/f/d40f6d9e1233aa80/setup2.ps1", "type": "url", "threat": "malware_download", "malware": "ClickFix, powershell, ua-ps", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "http://154.217.234.59:9100/GodPotato-NET4.exe", "type": "url", "threat": "malware_download", "malware": "GodPotato", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "https://gitlab.com/triageclap/litesign/-/raw/main/W52UE52XBY31.exe", "type": "url", "threat": "malware_download", "malware": "gitlab", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/accellirs/JJSploit/refs/heads/main/JJSploit.exe", "type": "url", "threat": "malware_download", "malware": "github", "confidence": 100, "first_seen": "2026-11-14 04:55", "source": "URLhaus" }, { "ioc": "https://dolphlinksan.online/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest", "type": "url", "threat": "malware_download", "malware": "exe, msi, rmm-abuse, connectwise, screenconnect", "confidence": 100, "first_seen": "2026-11-14 04:52", "source": "URLhaus" }, { "ioc": "https://github.com/djlenyx506-ops/LenyxServer/releases/download/dvfdf/WinUpdateManager.exe", "type": "url", "threat": "malware_download", "malware": "CoinMiner, miner", "confidence": 100, "first_seen": "2026-11-14 04:52", "source": "URLhaus" }, { "ioc": "https://dolphlinksan.online/Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest", "type": "url", "threat": "malware_download", "malware": "exe, msi, rmm-abuse, connectwise, screenconnect", "confidence": 100, "first_seen": "2026-11-14 04:52", "source": "URLhaus" }, { "ioc": "https://raw.githubusercontent.com/4444-dev/fortnite-loot-esp/refs/heads/main/fortnite_overlay.exe", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 04:52", "source": "URLhaus" }, { "ioc": "https://bjyunte.com/comp.exe", "type": "url", "threat": "malware_download", "malware": "injector, trojan, WARDENStealer", "confidence": 100, "first_seen": "2026-11-14 04:52", "source": "URLhaus" }, { "ioc": "teste.ghostnfc.site", "type": "domain", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 90, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "ghostnfc.site", "type": "domain", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 90, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "cdn-stripe.global", "type": "domain", "threat": "cc_skimming", "malware": "magecart", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "wafsearch.wiki", "type": "domain", "threat": "payload_delivery", "malware": "magecart", "confidence": 90, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "checkout-ovri.digital", "type": "domain", "threat": "cc_skimming", "malware": "magecart", "confidence": 90, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "panel.legion-x.tech", "type": "domain", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 85, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "love-support.world", "type": "domain", "threat": "payload_delivery", "malware": "magecart", "confidence": 75, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "http://23.94.145.243/s/37bb235b7995", "type": "url", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "https://195.15.201.210/gate", "type": "url", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "https://dx.andora188.org/vg/gate", "type": "url", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "https://ov.apacu500.org/", "type": "url", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "http://92.118.232.18:443/api/heartbeat", "type": "url", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "92.118.232.18:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "https://frees.tattoo/", "type": "url", "threat": "botnet_cc", "malware": "Remus", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "http://92.118.232.18:443/api/register", "type": "url", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "http://92.118.232.18:443/api/loot", "type": "url", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "http://92.118.232.18:443/api/trace", "type": "url", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "https://cybede.wiki/", "type": "url", "threat": "botnet_cc", "malware": "Remus", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "https://devpse.wiki/", "type": "url", "threat": "botnet_cc", "malware": "Remus", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "https://blapt.tattoo/", "type": "url", "threat": "botnet_cc", "malware": "Remus", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "https://debuginfo.org/", "type": "url", "threat": "botnet_cc", "malware": "Remus", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "https://procer.onl/", "type": "url", "threat": "botnet_cc", "malware": "Remus", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "debuginfo.org", "type": "domain", "threat": "botnet_cc", "malware": "Remus", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "frees.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "Remus", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "blapt.tattoo", "type": "domain", "threat": "botnet_cc", "malware": "Remus", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "54.232.140.167:4000", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "03afdfd14b602ac5df5c7d1ecb367788b5e28e7cb67a95106ab282cba4cc8c25", "type": "sha256_hash", "threat": "payload", "malware": "Unknown RAT", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "5aaeca1091c46165ec1360e8b348fac98fa26de848b16a837cef20500dad10e6", "type": "sha256_hash", "threat": "payload", "malware": "Unknown RAT", "confidence": 100, "first_seen": "2026-11-14 04:51", "source": "ThreatFox" }, { "ioc": "systhub.top", "type": "domain", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-14 04:50", "source": "ThreatFox" }, { "ioc": "https://vinandrite.com/ruf", "type": "url", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-14 04:50", "source": "ThreatFox" }, { "ioc": "185.198.56.60:6667", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-14 04:50", "source": "ThreatFox" }, { "ioc": "45.79.33.42:6667", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-14 04:50", "source": "ThreatFox" }, { "ioc": "45.58.135.130:6667", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-14 04:50", "source": "ThreatFox" }, { "ioc": "212.102.48.58:6667", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-14 04:50", "source": "ThreatFox" }, { "ioc": "https://pub-9edd485f8a3c4fb1942935530b075a5d.r2.dev/ScreenConnect.ClientSetup.msi", "type": "url", "threat": "payload_delivery", "malware": "Unknown RAT", "confidence": 90, "first_seen": "2026-11-14 04:50", "source": "ThreatFox" }, { "ioc": "metric.mintweekly.click", "type": "domain", "threat": "botnet_cc", "malware": "RevStealer", "confidence": 75, "first_seen": "2026-11-14 04:48", "source": "ThreatFox" }, { "ioc": "http://182.114.34.235:43048/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 04:47", "source": "URLhaus" }, { "ioc": "http://163.142.92.88:33778/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 04:28", "source": "URLhaus" }, { "ioc": "http://42.176.97.42:47229/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 04:17", "source": "URLhaus" }, { "ioc": "https://gitlab.com/marlyflash/escape-from-tarkov-cheat-undetected-with-aimbot-esp-wallhack-radar-hack-and-more/-/raw/main/eft_hack.zip", "type": "url", "threat": "malware_download", "malware": "gitlab, LummaStealer", "confidence": 100, "first_seen": "2026-11-14 04:14", "source": "URLhaus" }, { "ioc": "https://gitlab.com/smokeyblood/silentum-spoofer/-/raw/main/SilentumSpoofer.zip", "type": "url", "threat": "malware_download", "malware": "gitlab, LummaStealer", "confidence": 100, "first_seen": "2026-11-14 04:14", "source": "URLhaus" }, { "ioc": "oq.apacu500.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 04:05", "source": "ThreatFox" }, { "ioc": "tx.apigcor88.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 04:05", "source": "ThreatFox" }, { "ioc": "111.229.193.40:22", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 04:05", "source": "ThreatFox" }, { "ioc": "49.234.39.80:60000", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 04:05", "source": "ThreatFox" }, { "ioc": "45.227.255.157:7443", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 04:05", "source": "ThreatFox" }, { "ioc": "http://topbnds.shop:8592/articles", "type": "url", "threat": "botnet_cc", "malware": "Remus", "confidence": 75, "first_seen": "2026-11-14 04:03", "source": "ThreatFox" }, { "ioc": "http://42.55.180.236:54145/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 04:02", "source": "URLhaus" }, { "ioc": "https://vid-security.top/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-14 04:00", "source": "ThreatFox" }, { "ioc": "vid-security.top", "type": "domain", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-14 03:59", "source": "ThreatFox" }, { "ioc": "9c7846ba26a7515556d620bf9b0663f8e8a4ae63311ef3edb2e9b0571828cf86", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-14 03:58", "source": "ThreatFox" }, { "ioc": "http://39.79.72.241:45764/i", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 03:50", "source": "URLhaus" }, { "ioc": "http://39.79.72.241:45764/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-14 03:40", "source": "URLhaus" }, { "ioc": "k7spnoil.ranta.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-14 03:36", "source": "ThreatFox" }, { "ioc": "3.165.190.81:443", "type": "ip:port", "threat": "botnet_cc", "malware": "NjRAT", "confidence": 100, "first_seen": "2026-11-14 03:35", "source": "ThreatFox" }, { "ioc": "http://98.36.141.73:38576/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 03:32", "source": "URLhaus" }, { "ioc": "http://112.192.143.98:49915/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 03:32", "source": "URLhaus" }, { "ioc": "http://153.117.15.26:50024/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-14 03:19", "source": "ThreatFox" }, { "ioc": "http://124.29.251.120:39196/Mozi.7", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-14 03:19", "source": "ThreatFox" }, { "ioc": "http://175.147.88.106:48457/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-14 03:19", "source": "ThreatFox" }, { "ioc": "http://123.14.85.49:60359/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 03:17", "source": "URLhaus" }, { "ioc": "https://gitlab.com/edgeraw/fivem-tz-project/-/raw/main/TZ_Project.zip", "type": "url", "threat": "malware_download", "malware": "gitlab, LummaStealer", "confidence": 100, "first_seen": "2026-11-14 03:16", "source": "URLhaus" }, { "ioc": "104.252.30.60:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "apigcor88.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "xm.apigcor88.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "no.apigcor88.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "ctn.apigacor889.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "q.apigacor889.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "w.apigacor889.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "92apigacor889.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "j.gam99.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "gam99.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "b.apigcor88.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "apigacor889.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "ad.apigcor88.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "z.gam99.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "x.gam99.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "o.gam99.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "m.gam99.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "ranta.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-14 03:15", "source": "ThreatFox" }, { "ioc": "https://t.me/h3llopk", "type": "url", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:14", "source": "ThreatFox" }, { "ioc": "https://195.15.201.249/gate", "type": "url", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:14", "source": "ThreatFox" }, { "ioc": "https://104.252.30.60/gate", "type": "url", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:14", "source": "ThreatFox" }, { "ioc": "https://telegram.me/h3llopk", "type": "url", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:14", "source": "ThreatFox" }, { "ioc": "https://steamcommunity.com/profiles/76561198603333756", "type": "url", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 03:14", "source": "ThreatFox" }, { "ioc": "http://87.5.146.232:51303/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 03:10", "source": "URLhaus" }, { "ioc": "82.156.197.147:8080", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-14 03:05", "source": "ThreatFox" }, { "ioc": "36c957d8fd1fed8275880bc29ac6479bb239102ed0eefe26b721341e2afc999d", "type": "sha256_hash", "threat": "payload", "malware": "Formbook", "confidence": 100, "first_seen": "2026-11-14 02:58", "source": "ThreatFox" }, { "ioc": "4f0439c96a33a8a273b155a1f6810e6cf6ad520fa25fd127790cf456f81e3dbf", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-14 02:58", "source": "ThreatFox" }, { "ioc": "afaf55ec975e42a4b3a1c110d7c9bd9bf355632e82f35e096b107b049f75a14c", "type": "sha256_hash", "threat": "payload", "malware": "RudeDevil", "confidence": 100, "first_seen": "2026-11-14 02:58", "source": "ThreatFox" }, { "ioc": "http://61.53.73.68:51073/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 02:47", "source": "URLhaus" }, { "ioc": "http://125.46.199.224:55599/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 02:17", "source": "URLhaus" }, { "ioc": "http://159.255.30.110:46892/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 02:17", "source": "URLhaus" }, { "ioc": "http://61.53.73.68:51073/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 02:17", "source": "URLhaus" }, { "ioc": "82.156.197.147:80", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-14 02:05", "source": "ThreatFox" }, { "ioc": "82.156.197.147:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-14 02:05", "source": "ThreatFox" }, { "ioc": "101.42.255.92:9000", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-14 02:05", "source": "ThreatFox" }, { "ioc": "http://125.45.8.101:35047/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 02:02", "source": "URLhaus" }, { "ioc": "http://125.46.245.25:44216/i", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-14 01:59", "source": "URLhaus" }, { "ioc": "8eefcc6985dee8ce8d451a034a29ecb0e3fe96d74da540956ec7f9d829d74610", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-14 01:58", "source": "ThreatFox" }, { "ioc": "8a03d25f900c0301235cacdd1fb17f98a845dd0b73a1292c2905734d752ef3d1", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-14 01:58", "source": "ThreatFox" }, { "ioc": "3f6d950304146e671ff9de563d3861b60112eed39b13fba4e8bd293750bdcff0", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-14 01:58", "source": "ThreatFox" }, { "ioc": "4b1178a7cf24888437012e347ba87329d9caa0caee75d9543b7e6e0ed03a7e70", "type": "sha256_hash", "threat": "payload", "malware": "WARDENStealer", "confidence": 95, "first_seen": "2026-11-14 01:58", "source": "ThreatFox" }, { "ioc": "f7f4aa82b8bed3d8998579518c468337a021221393f7ff95577b66a53518078c", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-14 01:58", "source": "ThreatFox" }, { "ioc": "b7eaf8f9e4bd4f69eb69494a3d7124bab061df80c585cfe23d101756153fd299", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-14 01:58", "source": "ThreatFox" }, { "ioc": "38.60.136.208:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-14 01:56", "source": "ThreatFox" }, { "ioc": "149.104.92.194:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-14 01:49", "source": "ThreatFox" }, { "ioc": "http://159.255.30.110:46892/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 01:47", "source": "URLhaus" }, { "ioc": "http://125.45.8.101:35047/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 01:47", "source": "URLhaus" }, { "ioc": "149.104.87.239:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-14 01:43", "source": "ThreatFox" }, { "ioc": "38.60.242.17:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-14 01:43", "source": "ThreatFox" }, { "ioc": "http://198.23.150.2/arm5", "type": "url", "threat": "malware_download", "malware": "elf, ua-wget", "confidence": 100, "first_seen": "2026-11-14 01:35", "source": "URLhaus" }, { "ioc": "http://94.244.36.34:52994/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 01:27", "source": "URLhaus" }, { "ioc": "http://120.28.137.173:42449/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 01:17", "source": "URLhaus" }, { "ioc": "138.197.215.50:8001", "type": "ip:port", "threat": "botnet_cc", "malware": "Aisuru", "confidence": 100, "first_seen": "2026-11-14 01:16", "source": "ThreatFox" }, { "ioc": "69.67.173.150:8001", "type": "ip:port", "threat": "botnet_cc", "malware": "Aisuru", "confidence": 100, "first_seen": "2026-11-14 01:16", "source": "ThreatFox" }, { "ioc": "139.59.99.46:8001", "type": "ip:port", "threat": "botnet_cc", "malware": "Aisuru", "confidence": 100, "first_seen": "2026-11-14 01:16", "source": "ThreatFox" }, { "ioc": "31.57.216.180:10213", "type": "ip:port", "threat": "botnet_cc", "malware": "CECbot", "confidence": 100, "first_seen": "2026-11-14 01:12", "source": "ThreatFox" }, { "ioc": "http://125.46.245.25:44216/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 01:02", "source": "URLhaus" }, { "ioc": "http://61.53.151.52:35980/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 01:02", "source": "URLhaus" }, { "ioc": "55e4f2cfd4c46fa19fd66778370df03f4644bfd3178f368697eda09548a8bae6", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-14 00:58", "source": "ThreatFox" }, { "ioc": "edfdafe9395f12f10b8e65a2b42c95cbf3686d8c403a01b1244dec8cd334670e", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-14 00:58", "source": "ThreatFox" }, { "ioc": "03ca680b35ea9a4feb88d2c390e0b1752c7c77f48c412d5d48f5a365c4bf1081", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-14 00:58", "source": "ThreatFox" }, { "ioc": "3151a0e6ca324900e6e7db0e2b7a58a25584bdd21855726af4ea460fab02bd70", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-14 00:58", "source": "ThreatFox" }, { "ioc": "http://125.47.209.230:51959/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 00:47", "source": "URLhaus" }, { "ioc": "82.156.197.147:8443", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 75, "first_seen": "2026-11-14 00:45", "source": "ThreatFox" }, { "ioc": "45.207.222.145:55413", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 75, "first_seen": "2026-11-14 00:45", "source": "ThreatFox" }, { "ioc": "http://125.43.103.214:43807/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-14 00:39", "source": "URLhaus" }, { "ioc": "http://219.156.185.71:49563/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 00:32", "source": "URLhaus" }, { "ioc": "http://61.53.151.52:35980/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 00:32", "source": "URLhaus" }, { "ioc": "ro.apacu500.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-14 00:05", "source": "ThreatFox" }, { "ioc": "111.170.33.226:6379", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 100, "first_seen": "2026-11-14 00:05", "source": "ThreatFox" }, { "ioc": "111.170.148.132:1521", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-14 00:05", "source": "ThreatFox" }, { "ioc": "http://182.121.142.107:46875/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-14 00:02", "source": "URLhaus" }, { "ioc": "e02aee7fc71ea85fe26ee02b8be5943ce1afa0d9a955e16f78fc4b288bc2e265", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "2174253d9e78ed616c82cf2c7334817b3af400cf98c9ac2f348aedb0801d280a", "type": "sha256_hash", "threat": "payload", "malware": "WARDENStealer", "confidence": 95, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "d48d8c87335633e9ccf35f6b2fcae5146cc357194ec3d9b4e74b94549b759a25", "type": "sha256_hash", "threat": "payload", "malware": "Coinminer", "confidence": 95, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "f426469d0938ef79dfaf3c821ab6f4034608433de8058e3d8a5a681a81ff7295", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 95, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "fe2f1da409b645088f91226eb730c677a37ec1134426f93c74e6afe2855b8bf8", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 95, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "b797e3534789157cff3ffb1299905648315d89316ff355d122c57e475be1a240", "type": "sha256_hash", "threat": "payload", "malware": "WARDENStealer", "confidence": 95, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "88ff3f71a48dc2c2caece93a579a2cc9fbf6552dad4889f1425881b6433c911b", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 95, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "b0cc539f7e795ad86e529ef0cdb6b95046dfd0e11bcd10397da4118fe21fd125", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 95, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "2ea911903802aac88fd73cc65b271737eb4d05024c98cf5845675c503b472341", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 95, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "b7f4cbde98525a79c38d64322dba7d9d2289e4903ad5a245e80ea3a6cfcc7ef5", "type": "sha256_hash", "threat": "payload", "malware": "WARDENStealer", "confidence": 95, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "d9bb4cb6977d817979c51558d4e12da10b747ed87122b219a62a1ce64576da92", "type": "sha256_hash", "threat": "payload", "malware": "WARDENStealer", "confidence": 95, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "60b22e07cd80d6171889f3a027168bb33dac7b7316223d4678bcf6d7f919d12e", "type": "sha256_hash", "threat": "payload", "malware": "Coinminer", "confidence": 95, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "1ce75f752118bf6039196bad7595b4cdf2fadc6189352c6988cedc5b65e21656", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "ffbb2d190c87f9832e705692d0f9bba7a885672b842a8503279ac50bf0eb0a69", "type": "sha256_hash", "threat": "payload", "malware": "WARDENStealer", "confidence": 95, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "b3754baad0507f55a54ffc9c37b9093a66471c11cf83af3345b61716f7ba2a45", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "d1a0c6fbe9b121685c40757989c8db4ac45c5a49a7f78775ee03a1153156dcb8", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "6fc2257aa8c382907a47853ad2a7f5326a923af5fc91e71cb030da50834ffe9b", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 95, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "d62601d11f25adce7d33f699b80fbe6ab457d0941336627ebe2640cb2675222f", "type": "sha256_hash", "threat": "payload", "malware": "ValleyRAT", "confidence": 95, "first_seen": "2026-11-13 23:58", "source": "ThreatFox" }, { "ioc": "http://netframework.dynamic-dns.net:8000/is-ready", "type": "url", "threat": "botnet_cc", "malware": "Houdini", "confidence": 100, "first_seen": "2026-11-13 23:55", "source": "ThreatFox" }, { "ioc": "http://222.127.158.71:46021/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-13 23:50", "source": "URLhaus" }, { "ioc": "http://182.121.142.107:46875/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-13 23:48", "source": "URLhaus" }, { "ioc": "route9.clearplaza.website", "type": "domain", "threat": "botnet_cc", "malware": "RevStealer", "confidence": 75, "first_seen": "2026-11-13 23:44", "source": "ThreatFox" }, { "ioc": "http://222.127.158.71:46021/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-13 23:33", "source": "URLhaus" }, { "ioc": "http://125.41.4.26:48720/bin.sh", "type": "url", "threat": "malware_download", "malware": "elf", "confidence": 100, "first_seen": "2026-11-13 23:11", "source": "URLhaus" }, { "ioc": "206.189.58.244:8001", "type": "ip:port", "threat": "botnet_cc", "malware": "Aisuru", "confidence": 100, "first_seen": "2026-11-13 23:09", "source": "ThreatFox" }, { "ioc": "fhqz6gm8.gomas.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-13 23:06", "source": "ThreatFox" }, { "ioc": "45.192.213.153:8084", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 100, "first_seen": "2026-11-13 23:05", "source": "ThreatFox" }, { "ioc": "104.251.181.64:8080", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 100, "first_seen": "2026-11-13 23:05", "source": "ThreatFox" }, { "ioc": "104.251.181.64:80", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 100, "first_seen": "2026-11-13 23:05", "source": "ThreatFox" }, { "ioc": "104.251.181.64:443", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 100, "first_seen": "2026-11-13 23:05", "source": "ThreatFox" }, { "ioc": "http://182.121.140.66:40162/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-13 23:02", "source": "URLhaus" }, { "ioc": "b4507d1dbf431ac6e2de7668d3ede2ae4677774a7cbb0d127b2255c0ec1c7e66", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 85, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "d1b80d5f73b327fb4077d36b80b248fe1e403d20b9706023eff3be35655bfe33", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "cdd6d3adb812f2b018e06f6ccbf3f141ed40b3a284c60b1dc97421f263d82107", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "f62a618a4289b7f50ee890ffd096e4a74178b12cdc2fca9092e3d3e068ecb6ed", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "8b6e5298a4a7e3da7bede6abc174af99bdbfc0282b1750410282050b83b38a69", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 95, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "712f44b90c8a14c071870cc0b7ce0328e594c117ac1004c1adfd99defd86145f", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 95, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "447478732888aa72cc09a934d893b4ae831b054db670f73c44a17c54b0e88dec", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "64c23252434dad5c4ff24063d0936a2bda3b3304de8a36ca73d2916b7565b12b", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "2bbba6f62ea49d9826492991a824c47a5562c9ed8be6eaeb8a9dec015b5bc0c7", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 95, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "88f35177758de73153e830964f6015464190d3d125f4f07a37ae707120093095", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "061d9820dc550f8fe032f4e1a38dbba9cfeaca6cbd215d3e58ab86ea6a3cf4c3", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "2f49e9b935e1f1a79505356a97697a6822fd662beeff960bce6143552e8dd64f", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "2404b5520fa1205f2bccf7a98d35268ac09772b258f4133f0269975d489a8aa9", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "eecb204514f4961d93147805cdef6d7e4060588f428db663db1889da59f3d8e2", "type": "sha256_hash", "threat": "payload", "malware": "Formbook", "confidence": 100, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "b3564ed868679fda9c6cd4a9f0c96cc812c2218effa5f2ab242cb411ac4548e2", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "b37a50c521283d0101a1fa453ca7e606c9fceee9d1f4d705508975a7da1c3cc7", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "e5566d680f0c6484b51bceb7d737340bd43aff97164b24bff8b326d02c038af4", "type": "sha256_hash", "threat": "payload", "malware": "AMOS", "confidence": 95, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "ae4f1b9547db90636514df913a422eff22ebf1cf60712e1f1ec5753b6e26a9e8", "type": "sha256_hash", "threat": "payload", "malware": "AMOS", "confidence": 95, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "2d352712cad9e47d9c8ce0b62589e7c09c2a5dd97bd35bf72140a252cc600ea3", "type": "sha256_hash", "threat": "payload", "malware": "AMOS", "confidence": 95, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "6eb257d6c98f152506268dacfe71c682a2203d808d6efa9b8f787b3f66a66721", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 100, "first_seen": "2026-11-13 22:58", "source": "ThreatFox" }, { "ioc": "http://120.28.194.92:53370/i", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-13 22:48", "source": "URLhaus" }, { "ioc": "http://115.55.39.221:48426/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-13 22:32", "source": "URLhaus" }, { "ioc": "http://120.28.194.92:53370/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, arm, elf, Mozi", "confidence": 100, "first_seen": "2026-11-13 22:24", "source": "URLhaus" }, { "ioc": "http://182.121.140.66:40162/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-13 22:17", "source": "URLhaus" }, { "ioc": "49.234.39.80:8080", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-13 22:05", "source": "ThreatFox" }, { "ioc": "49.234.39.80:80", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-13 22:05", "source": "ThreatFox" }, { "ioc": "49.234.39.80:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-13 22:05", "source": "ThreatFox" }, { "ioc": "http://115.55.39.221:48426/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-13 22:02", "source": "URLhaus" }, { "ioc": "cf690ffe7647238ad2744224327de38a6d23826eb8e8ecde32f0a37294fa2b0e", "type": "sha256_hash", "threat": "payload", "malware": "Ramnit", "confidence": 90, "first_seen": "2026-11-13 21:58", "source": "ThreatFox" }, { "ioc": "ced186a8664f5ed95a4f516d04e614a27d2407536dd69b5cb8c0045cd3db1900", "type": "sha256_hash", "threat": "payload", "malware": "AdaptixC2", "confidence": 95, "first_seen": "2026-11-13 21:58", "source": "ThreatFox" }, { "ioc": "http://222.142.252.54:40470/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-13 21:32", "source": "URLhaus" }, { "ioc": "http://203.101.186.49:44317/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-13 21:19", "source": "ThreatFox" }, { "ioc": "http://153.117.34.117:52811/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-13 21:19", "source": "ThreatFox" }, { "ioc": "http://27.14.215.22:50155/i", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-13 21:17", "source": "URLhaus" }, { "ioc": "http://60.209.182.113:58772/bin.sh", "type": "url", "threat": "malware_download", "malware": "", "confidence": 100, "first_seen": "2026-11-13 21:17", "source": "URLhaus" }, { "ioc": "43.157.55.140:6666", "type": "ip:port", "threat": "botnet_cc", "malware": "ValleyRAT", "confidence": 75, "first_seen": "2026-11-13 21:15", "source": "ThreatFox" }, { "ioc": "http://117.102.208.80:43986/bin.sh", "type": "url", "threat": "malware_download", "malware": "32-bit, elf, mips, Mozi", "confidence": 100, "first_seen": "2026-11-13 21:05", "source": "URLhaus" }, { "ioc": "b1.apacu500.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 20:05", "source": "ThreatFox" }, { "ioc": "yyy.06services.it", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-13 20:01", "source": "ThreatFox" }, { "ioc": "2c85a21fe7baf0defdf8f36da2afa9fa8aa87bfd884f528392da3958f07f0416", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 19:58", "source": "ThreatFox" }, { "ioc": "154.9.235.100:80", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 75, "first_seen": "2026-11-13 19:45", "source": "ThreatFox" }, { "ioc": "154.9.235.100:443", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 75, "first_seen": "2026-11-13 19:45", "source": "ThreatFox" }, { "ioc": "85.189.45.191:8080", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 100, "first_seen": "2026-11-13 19:05", "source": "ThreatFox" }, { "ioc": "85.189.45.191:80", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 100, "first_seen": "2026-11-13 19:05", "source": "ThreatFox" }, { "ioc": "85.189.45.191:443", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 100, "first_seen": "2026-11-13 19:05", "source": "ThreatFox" }, { "ioc": "apkwings.epizy.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-13 19:01", "source": "ThreatFox" }, { "ioc": "mkac2tdb.gofur.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-13 19:00", "source": "ThreatFox" }, { "ioc": "1820de6f0725b664ed3f29b353cdd089915cb04fe2e6af472b72f92842aaa8c8", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 18:58", "source": "ThreatFox" }, { "ioc": "357b9b2165d63dd80a6be088c42185db8b207eb202b3609628cc69322270e9ff", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 18:58", "source": "ThreatFox" }, { "ioc": "corporateatm.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-13 18:01", "source": "ThreatFox" }, { "ioc": "97bd502de34b7c65de54281a01fa7281d17daeb036f089b360ced2c775254b84", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 17:58", "source": "ThreatFox" }, { "ioc": "913bd447966819115cf0d895e0e7e01aabe703fab76bf1ab876bc37fe125c276", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 17:58", "source": "ThreatFox" }, { "ioc": "f99021c2c8d57811bd4fe3da3a0fafba437e979e0c1af74a96360a05440225a4", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 17:58", "source": "ThreatFox" }, { "ioc": "a51458c1fabcd9daa067042afb5647fb9d02dd2713dce1fe64f4779f34be7c8a", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 17:58", "source": "ThreatFox" }, { "ioc": "bf00e39d5d09fa3be243cc3b443437de9cb9fd63d180731cb7d5236a37835f0c", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 17:58", "source": "ThreatFox" }, { "ioc": "b0381985b6201ef48bc110d733ab2bc9edd42caca39dc604b7818cefe6b46765", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 17:58", "source": "ThreatFox" }, { "ioc": "9da8d38d474ba612931b44256190a78e0fab9af7cbdeba41f63e7f05e30b71e1", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 17:58", "source": "ThreatFox" }, { "ioc": "a4a47dc95ba93ad357fcf958dae99b19ca0a0dae6cb8b698846706e1ad61f55b", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 17:58", "source": "ThreatFox" }, { "ioc": "pagarklasik.info", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-13 17:51", "source": "ThreatFox" }, { "ioc": "https://3g1ln6r5bajofdx.icu/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-13 17:30", "source": "ThreatFox" }, { "ioc": "51.89.166.173:65535", "type": "ip:port", "threat": "botnet_cc", "malware": "Quasar RAT", "confidence": 100, "first_seen": "2026-11-13 17:20", "source": "ThreatFox" }, { "ioc": "129.211.183.201:18084", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 17:05", "source": "ThreatFox" }, { "ioc": "129.211.183.201:18082", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 17:05", "source": "ThreatFox" }, { "ioc": "asyncify.fun", "type": "domain", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 100, "first_seen": "2026-11-13 16:50", "source": "ThreatFox" }, { "ioc": "673feccbcec6008354e4b3b7711de22953445d5314721097b041eb020e6cd231", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 90, "first_seen": "2026-11-13 16:45", "source": "ThreatFox" }, { "ioc": "https://4sanv4aE-60244a98-f2A8bcfa67fd.sagevale.cc/cinstall.ps1", "type": "url", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-13 16:45", "source": "ThreatFox" }, { "ioc": "nvidla.my", "type": "domain", "threat": "botnet_cc", "malware": "Winos", "confidence": 90, "first_seen": "2026-11-13 16:45", "source": "ThreatFox" }, { "ioc": "62.171.172.71:7500", "type": "ip:port", "threat": "botnet_cc", "malware": "PureRAT", "confidence": 75, "first_seen": "2026-11-13 16:45", "source": "ThreatFox" }, { "ioc": "52.128.230.19:443", "type": "ip:port", "threat": "botnet_cc", "malware": "PureRAT", "confidence": 75, "first_seen": "2026-11-13 16:45", "source": "ThreatFox" }, { "ioc": "46.183.221.117:6606", "type": "ip:port", "threat": "botnet_cc", "malware": "AsyncRAT", "confidence": 75, "first_seen": "2026-11-13 16:45", "source": "ThreatFox" }, { "ioc": "36.138.100.216:45991", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 75, "first_seen": "2026-11-13 16:44", "source": "ThreatFox" }, { "ioc": "207.189.11.101:6607", "type": "ip:port", "threat": "botnet_cc", "malware": "AsyncRAT", "confidence": 75, "first_seen": "2026-11-13 16:44", "source": "ThreatFox" }, { "ioc": "206.189.166.14:65000", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 16:44", "source": "ThreatFox" }, { "ioc": "196.251.121.237:777", "type": "ip:port", "threat": "botnet_cc", "malware": "DCRat", "confidence": 75, "first_seen": "2026-11-13 16:44", "source": "ThreatFox" }, { "ioc": "192.248.190.87:4321", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 75, "first_seen": "2026-11-13 16:44", "source": "ThreatFox" }, { "ioc": "167.99.175.19:65000", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 16:43", "source": "ThreatFox" }, { "ioc": "157.20.182.100:443", "type": "ip:port", "threat": "botnet_cc", "malware": "PureRAT", "confidence": 75, "first_seen": "2026-11-13 16:43", "source": "ThreatFox" }, { "ioc": "138.68.63.70:65000", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 16:43", "source": "ThreatFox" }, { "ioc": "128.90.106.61:7000", "type": "ip:port", "threat": "botnet_cc", "malware": "DCRat", "confidence": 75, "first_seen": "2026-11-13 16:43", "source": "ThreatFox" }, { "ioc": "128.90.105.235:8081", "type": "ip:port", "threat": "botnet_cc", "malware": "AsyncRAT", "confidence": 75, "first_seen": "2026-11-13 16:43", "source": "ThreatFox" }, { "ioc": "107.175.246.27:6606", "type": "ip:port", "threat": "botnet_cc", "malware": "AsyncRAT", "confidence": 75, "first_seen": "2026-11-13 16:43", "source": "ThreatFox" }, { "ioc": "104.251.181.64:1344", "type": "ip:port", "threat": "botnet_cc", "malware": "AdaptixC2", "confidence": 75, "first_seen": "2026-11-13 16:43", "source": "ThreatFox" }, { "ioc": "130.12.181.125:10213", "type": "ip:port", "threat": "botnet_cc", "malware": "CECbot", "confidence": 100, "first_seen": "2026-11-13 16:26", "source": "ThreatFox" }, { "ioc": "cs.apacu500.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 16:05", "source": "ThreatFox" }, { "ioc": "129.211.183.201:80", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 16:05", "source": "ThreatFox" }, { "ioc": "103.112.172.143:22", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 16:05", "source": "ThreatFox" }, { "ioc": "45.207.208.51:4444", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-13 16:05", "source": "ThreatFox" }, { "ioc": "82.21.200.57:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-13 15:39", "source": "ThreatFox" }, { "ioc": "82.21.200.56:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-13 15:32", "source": "ThreatFox" }, { "ioc": "dyntra.it.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-13 15:25", "source": "ThreatFox" }, { "ioc": "outboxxsales.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-13 15:25", "source": "ThreatFox" }, { "ioc": "http://124.229.35.63:42162/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-13 15:18", "source": "ThreatFox" }, { "ioc": "http://112.248.185.53:52226/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-13 15:18", "source": "ThreatFox" }, { "ioc": "http://59.103.104.99:45497/Mozi.a", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-13 15:18", "source": "ThreatFox" }, { "ioc": "http://119.30.116.199:41471/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-13 15:18", "source": "ThreatFox" }, { "ioc": "http://100.10.4.194:42856/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-13 15:18", "source": "ThreatFox" }, { "ioc": "http://72.255.32.70:39603/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-13 15:18", "source": "ThreatFox" }, { "ioc": "in71deke.geted.site", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-13 14:59", "source": "ThreatFox" }, { "ioc": "b8e9cba6c5f0f81c378217a2da16e6ab91d9c93c94edc5d965d97f5128e1946f", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 13:58", "source": "ThreatFox" }, { "ioc": "1842f387b9ac9cba8c01a8a7a1b73b6ae7032311c76a8da41596aae26d407037", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 13:58", "source": "ThreatFox" }, { "ioc": "346a1bf30bed7f14f4c91a9ca34ed964cf7057ca7bce50ca7b47e523c583dc2f", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 13:58", "source": "ThreatFox" }, { "ioc": "867ad6f6f103765c59cb85c180cfefc36d958fc11bf6ff3cbf49511913a180bc", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 13:58", "source": "ThreatFox" }, { "ioc": "ff0a67e00e9ed435ae4d308dc882778806ef1eec9901a159f925703a2b384721", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 13:58", "source": "ThreatFox" }, { "ioc": "b01871c324e175107500e2e84a094b29944724a70ccce41d58bd556d30808cda", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 13:58", "source": "ThreatFox" }, { "ioc": "00f0dcd03fefbcfe1544865b9b9ea8c199e42f752a5a37a40c296af5b922f6c8", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 13:58", "source": "ThreatFox" }, { "ioc": "5f5b474068cc57180053c06f6ebd861b3d4abb25aa242604f77c461ee4030779", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 13:58", "source": "ThreatFox" }, { "ioc": "689b2974f8f5fa5a219f7e6283901c2cb08ac7b7b949231080834d0695669e8c", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 13:58", "source": "ThreatFox" }, { "ioc": "5f06679a94844656d74ccac5cb1137e5d121eca43a0f695c9055145e12e83f8b", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 13:58", "source": "ThreatFox" }, { "ioc": "0f7782fcfc2a54f30400f3e851df68b1da45ce71558e3dee57abbca0aab8bcc3", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 13:58", "source": "ThreatFox" }, { "ioc": "ea1c27dcd8f7ad7150a46da134c32eda448660086bf267a9275af2ede4b8c510", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 13:58", "source": "ThreatFox" }, { "ioc": "d63ee6742fe5e031bbcfb618b4aa7b4f28b925566e8b465e2ec6fe443c9c916d", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 13:58", "source": "ThreatFox" }, { "ioc": "c8eedc0624809ec5662fca3665bd7d0679bae825541a42190dcba177007c3837", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 13:58", "source": "ThreatFox" }, { "ioc": "66ebf9848cd2bf57aa88597aac848f8cc8b7f88e271c1430ae6e5fe9e1b48d71", "type": "sha256_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 75, "first_seen": "2026-11-13 12:58", "source": "ThreatFox" }, { "ioc": "552d979fea44774298a7bc6c40f9044d", "type": "md5_hash", "threat": "payload", "malware": "MiniBrowse", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "0609b6e551ae04085b9b1e39a053365b498377d1", "type": "sha1_hash", "threat": "payload", "malware": "MiniBrowse", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "26d708f52be9ed674be19612612ece022d6c782e", "type": "sha1_hash", "threat": "payload", "malware": "PetitPotato", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "d99eb978d6c2a2a737a6ccf16441a46c83ae7fa0ab827720e957eda4f77dba18", "type": "sha256_hash", "threat": "payload", "malware": "MiniBrowse", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "615680214ee7f74c1764ae6194683333", "type": "md5_hash", "threat": "payload", "malware": "PetitPotato", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "f9a00ebde97b4becbf1d12934b16ab4535b7292e", "type": "sha1_hash", "threat": "payload", "malware": "Meterpreter", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "e178908eeae1ce9eb025d91076101039", "type": "md5_hash", "threat": "payload", "malware": "Meterpreter", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "aa3e9d882ac75c22f1843b6e7b2706b1b3fc9829", "type": "sha1_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "cb7c579ab778ffd1751dcd9b5f036589", "type": "md5_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "4df68e033eec7ee2ccf8474607ae1f7c", "type": "md5_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "50774628062fd31b15c9873660cf033e457d5b88001de1a3a2779f800b6ba16b", "type": "sha256_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "dba026b327c383284a01e36c955d7c97d4aec6e3", "type": "sha1_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "d45361634083c162b50eca92a50e0410c538e31f51508b74f047415ab8ebb9e1", "type": "sha256_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "37fc80c2735e68045fca2491784d92ac", "type": "md5_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "eb63d23ab0b1415e7a625edf8513d00d6323112d", "type": "sha1_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "7232d7791ac683102556cd203e4613dbbc606a32a7bd6ed6808e171afe81c96c", "type": "sha256_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "9e466d4a4a6a9fcfa3e53d485ec09873", "type": "md5_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "f96e4518fc730672702d5e2dccd1b33823c305e5", "type": "sha1_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "af1669913e244deebb9496a33264741b", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "b2550d2c1b7b9a8d58e2b5a0171a175809e9deedde12fe4a58fc951861d55d84", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "9bbcc904ed42b0baa4e975828daa61a2a2e93c8d", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "8afc276d54258cde26aa5259a4d51729", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "f45b1b15466a574ceecaa380efc0dc4b3596ef70", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "2464420ca60f61d7438f13633db34e86", "type": "md5_hash", "threat": "payload", "malware": "WannaCryptor", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "28ffea472ed7e2300fdde6d3f1074608dbe415d5d851834e96052f65dd0ca386", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "25c1dca57b882d184f6a0c426ea06c62", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "69769ea6ce90420aa08968c589ee96f23a602bc8f9483b4a7af8dfe058cca460", "type": "sha256_hash", "threat": "payload", "malware": "WannaCryptor", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "042ba6e13440028b31f32c04809ba964a57f0da1", "type": "sha1_hash", "threat": "payload", "malware": "WannaCryptor", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "ec77662d1d154d144789ac1848d04200f3acfc7f", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "255bf1223a9145bcbdda4d06e2880e5e", "type": "md5_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "2057f65c6a9aee75b7c86ee73b61816a805a38581dfd18d229f6b5741fd9506b", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "3232dda0c8c948eeafb8f2b82f4867d0", "type": "md5_hash", "threat": "payload", "malware": "neshta", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "f3cfaf8e583dfbe20d23ca8b9e41c6fb0a13d26a74099b5b93032744cd2315b9", "type": "sha256_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "885ef789dd61ca7193f5207335691572e2f3c52e", "type": "sha1_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "471ba113d255eb2efa2866af47e0c890d70e0384", "type": "sha1_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "9602dccb00d5a14aad4cb3df5834f8af5f04330a7de7d61d2b559b1e1665fe57", "type": "sha256_hash", "threat": "payload", "malware": "neshta", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "8543eb0b4fcbbee94813b705ecfdf86ba8a9dfd1", "type": "sha1_hash", "threat": "payload", "malware": "neshta", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "328186d0c7ed49a69742ef70d9efa079", "type": "md5_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "7ea3c869cc37841e64964e804e6fb77dc11b7a25ff1c4b2c59c368d012b9f836", "type": "sha256_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "e2d45c91caa3f6c76233dcb2f8e72566", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "f6743510b235167cbc987c53e1542dcdedffd403d59e29f58a431ffe3b1c97db", "type": "sha256_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "703ac7b3fb5927f4ad934c55ccbafbc4b63fd3d8", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "355197e56f8eb221c756d56861e3ff6d", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "e4e28fe3cf6a810daeac0265bd9571b4905305a12b6eebaa1454a7c25c515715", "type": "sha256_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "fb7dae67edad967a41bd784affaaa73699a881ab", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "8fc76662c5a7d691f9b4afc81bee574da3261300e4ae56275688e6f0dfe184e0", "type": "sha256_hash", "threat": "payload", "malware": "SnappyClient", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "8e0cdf3d01f54bc3c502205a50e8d3e1", "type": "md5_hash", "threat": "payload", "malware": "SnappyClient", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "651206113b1b1fce33ebb18ecc0bff90c0620a5c", "type": "sha1_hash", "threat": "payload", "malware": "SnappyClient", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "0a0f5915ae2ff454f9d59d7e88de05fb", "type": "md5_hash", "threat": "payload", "malware": "NetWire RC", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "3e87c6dddfa6363b885672e6d006b9f5af714c67b61ff158a5fc8e709a64d866", "type": "sha256_hash", "threat": "payload", "malware": "NetWire RC", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "c6ba36ffcf4386ef9fd0818c9339174ac9a23204", "type": "sha1_hash", "threat": "payload", "malware": "NetWire RC", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "e92e421fb588e880c229970ff4e04dc5", "type": "md5_hash", "threat": "payload", "malware": "StarLoader", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "669b7c85b2949e52daf3e8e218a5661970731661", "type": "sha1_hash", "threat": "payload", "malware": "StarLoader", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "5f8b41a88396a0fd827cba22d7861e5e", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "797b476e8179fe56633742961d3326250d9a135a", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "f70900ebe73802831ab154b375666bdf4d677117d557f34284e3b5fe7e1f0eef", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "a0a710fd654559527bcffd366bd68857", "type": "md5_hash", "threat": "payload", "malware": "SnappyClient", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "33d9d819e92eeec4cf577a65f19587f6b11c2822", "type": "sha1_hash", "threat": "payload", "malware": "SnappyClient", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "b14d9f4c8e991a44ba5e9d6263779ce63d56978579758900d5d11cf20a873332", "type": "sha256_hash", "threat": "payload", "malware": "SnappyClient", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "4e17e32786ac0b09aa48f83e79258a91", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "cabe32d52bd8513a8806e28512c22f82146520f2", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "86b54a301b3958ecff0a61237090a350ae22fd9833a66518db95556912ed571d", "type": "sha256_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "5147eb9ad4d289ebfcfb17713bb97ebe", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "45c4190f5310c92b6a666c107175d20ee09e784f", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "047b911e24115c5f9dd4b2a1108bf465aa87f06dfd1d028087cfdaefdd4cfbfc", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "e30d23a32473f43f2ced8a68c726fa91", "type": "md5_hash", "threat": "payload", "malware": "Ghost RAT", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "06c14d68ee8666e2498e3668c104edbb6e386d82", "type": "sha1_hash", "threat": "payload", "malware": "Ghost RAT", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "5814dbd3853615c2434ec17c83ee53a4ad71691d0626c6b86d8f6f9e6fdb27e1", "type": "sha256_hash", "threat": "payload", "malware": "Ghost RAT", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "68b6db3565fd5850f1fb8b2b515d3150", "type": "md5_hash", "threat": "payload", "malware": "WannaCryptor", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "f0ea1a6e1b9941ccce2607e740ac7fe1108a1254", "type": "sha1_hash", "threat": "payload", "malware": "WannaCryptor", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "533e67aa31d63a0ba46ce26b18962508c13fc6a31a6e8a001ab059e5f2cf34b9", "type": "sha256_hash", "threat": "payload", "malware": "WannaCryptor", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "b8cd5e7e7e90ffc4b0a7779cd3e2d8ac", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "23f79f26e6b4e24906b46c006662fe0c96238fde", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "3c6330d06b57d18026efd5745245cc19e1c67983d957f42ff6a821e2b7f71632", "type": "sha256_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "51061df0511cc9d758230ba75f3954b4", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "3825294295308af935147e6fa2a492227e215401", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "eef82bab267ed96d30653ffad896c002", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "76e6f85a21a5ad91509cd38bd93967e8f105efba", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "71e12ceaead7551f78e717b981835240fdf17efa", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "5e36fbd053c4f4660df504ad22497a30", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "e490875da0eb078238304d80864be92aba5dd98b034813aeb15c7c24a68f9251", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "dfc8cc5ca2583872b90e63a99707a5b5", "type": "md5_hash", "threat": "payload", "malware": "Havoc", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "778860538b577ce6cd8fd1a10a256381ef6dccde", "type": "sha1_hash", "threat": "payload", "malware": "Havoc", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "0aff424f9a02eb9f429119c4caa05e85fc952603549d69849e745293d20235d6", "type": "sha256_hash", "threat": "payload", "malware": "Havoc", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "cd87da979087f12606a1ab99b37f1ab9af0d49fa", "type": "sha1_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "a5aff9204c3ebd5da9ec59ecbb77ef0dd7c479fdfdb951f8bb3cf77038fb8fc5", "type": "sha256_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "15d0b0f44a40bd7fa1b7118ad81d094d", "type": "md5_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "8a37a7822bbdcc7b359fe941a14c3344be22b1c9", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "5527238dc1de3f3141b41816cfd1073ec88f6b9d0f10b6ebfbe70b4eb79cab97", "type": "sha256_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "1a672cebbc966188cd5ae180a91fa4a3", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "7a06a31b2d0d59c19be47ebd999b353ce9fc859a", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "714fde47749e59b91c384886900622cc", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "7bc829737dda8a4a12045a92cc33b91bf75eab07aee15e902ab91fbaa9c751b8", "type": "sha256_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "4663a1694b9419f3a64d8e01edda88d3940c90f4", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "76b5e7a0958f9999679bbeba79dce2cb", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "7f575e6d6e7d17ac336f8ed0fdd443cb", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "3f2ed02c73291e0fa39fb2ddb18325e16f44405b", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "7ad74326c1cdd94472c7f41abbd63723917e0f5ac67c937de1243aa00b6b77bc", "type": "sha256_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "a6786852d62b282de0c07ad977b80ef2", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "99a442653f7f58990edd6d9cf43f5045880cd1165d711aade8a75f9804ab557e", "type": "sha256_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "17c03fc121effd00c087acaed2eec4a8859143c18798c6d2f255c764d1faab46", "type": "sha256_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "a02778452b3ed50cca94b36ba827b2386c4e92da", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "22207c8cc9304136a53b1871c3990978", "type": "md5_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "58f0e102c28d3ebdd5f479b1f38c8a1f389f1ed9", "type": "sha1_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "9e8144a666abd838ab928f8213313c88967e15a3cd9616c8f011964d6feaa08f", "type": "sha256_hash", "threat": "payload", "malware": "Vidar", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "ea6769a1e9331830404355a470d6dc88d04e00ec", "type": "sha1_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "93e4f11ce8db04be2b2142b114eb0da5", "type": "md5_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "90e04a3d2b66e332ae0e74f86b64c321", "type": "md5_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "2edce90bad4aea4fe7b2e0cdc020bdd0fe3963d7680966da6e7f1ed813374446", "type": "sha256_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "bafffbfd9358d6c07255299032bd3a6cf9e5ec27", "type": "sha1_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "cb5b93de373962ee2d1f1da2c4dbfff8", "type": "md5_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "15761256d7a311a771b50264130dd6ecc1f147984b2fff9b0d9751eb2b7ce864", "type": "sha256_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "2ffcbdcb8f0aa2754e5b34cbe5c9b524b11f4fc6", "type": "sha1_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "609fd6140d6a600ecaa202deaa4ebee6", "type": "md5_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "5cf82b2f85908f03da9e328f1046d6a643d4e141", "type": "sha1_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "ba66d509c4d6eb46ae04eabe36a83116fb8da7f8f9e67eb734353bfd23a5c28b", "type": "sha256_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "cb95ac747beb6690b5ed31f46d0cfb0a8aecaf62", "type": "sha1_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "99e68c1be455ec0a085afe77fa48ff4aab6d6d56824b31c84d48012d6768d89c", "type": "sha256_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "74ecf1cd2110f974ca681de1dbcef0cf", "type": "md5_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "50c93e5534101cc47b6704465e2122e0", "type": "md5_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "d5a515a455e2e14f293cb8f14f1c09f3708affad5f4e84d2396e22d93a07e982", "type": "sha256_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "2109774041d3e6711b6492e96f294f6a3c997168", "type": "sha1_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "6a847028aad63b4e7cec58d92be51a7f02426900", "type": "sha1_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "a6e4bb30360567900975b400e5a376ce", "type": "md5_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "29ba415aed4e6acd2bc4433f9dddd52d7473387389d92c5c895c83fbdb1da394", "type": "sha256_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "d4e0e0744b01196b06edde6663d34e4531e42a82", "type": "sha1_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "9a9646a99eca2179c1e92a44ce11ca437b55a41fdf4c140bf3554bf30dfcb736", "type": "sha256_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "1e76785e86ad8f6c459d35e5d868c6e1", "type": "md5_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "de78884690d0337f8d9f90daf66893da", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "404b7dc15beaccb34bd250b9cc283b3f32fb0de78c563ef5b39e43ba893c3b4e", "type": "sha256_hash", "threat": "payload", "malware": "ZStealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "7cfd3a2aba3a6cc8a66b94a62fa008a1dfbe898b", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:28", "source": "ThreatFox" }, { "ioc": "f43ae78195d67187f3c97a0f8986ea661fcdd01a91f8682df96273d24356958d", "type": "sha256_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "ad4acb80cf9ab2ab6943e7507b3ad097", "type": "md5_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "654af7da424d61cb221be51e3f9ac15fe15e18c1", "type": "sha1_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "686c3ba4b40f1be0ef0b85bbd540c2091ec22e05", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "7be3ea61528c4c7885f02fc5ae35a0bf56510434e00cf79f9cd71f0af63b5f99", "type": "sha256_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "e3a6c90482ce0b95cb3ea92a70cb72ac", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "f360181fb026eead6f1dd892cd23236e", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "94f3bb97cd7ec26ad8829faf43e9a91a5a7f7fe4f4b3667aa1fa93a2a86a0411", "type": "sha256_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "07d4c0fcad0ab6b18fd064e56de67b6c4deabec7", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "f8a4cdad8bddd87c6e84f88fa3b6e97d", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "22c11f5f299dfc3908582caaace06b7b121370db9ec53faab9422416a91228ad", "type": "sha256_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "134abdbffb6ad898af1d7bc6f15d5f1bc8d597e5", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "7e5361f39537ca42c8f58303c95844d5042df3a2caa443c615ef25a2fc15f078", "type": "sha256_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "b0432c52007f5e213a2e22a352886728", "type": "md5_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "1c0794f74cd0520dfa1580112d904fa39cb7ae062c10904743f7bd0422384a4a", "type": "sha256_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "5dd794966bc7cf9f2e4166996e07b03c", "type": "md5_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "2a75eb493c6fb2a3ec01f40dba1f14b6eeadacfb", "type": "sha1_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "24d3bfeb08afeec2b4ded786913df0b30fc08aecabef0544d8f47f61883ae0b1", "type": "sha256_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "bc76cb53bb061eeb64442436021d6c2fc02f0438", "type": "sha1_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "a0fb265c528e52e920fbd14cc9ad7ada", "type": "md5_hash", "threat": "payload", "malware": "GUIDLOADER", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "2056630fe4f6ac0dddd4041e00f3e4f490b5b19d", "type": "sha1_hash", "threat": "payload", "malware": "GUIDLOADER", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "475b7002fe1981c7acd3d420fead8bd384b6140ce84478fa9774f7dbd4be868e", "type": "sha256_hash", "threat": "payload", "malware": "GUIDLOADER", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "0057a5e704d79ebf69fb8c3039da50423c314d03", "type": "sha1_hash", "threat": "payload", "malware": "MASS Logger", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "5230cdf8a8c31f24b447dde5f6379382", "type": "md5_hash", "threat": "payload", "malware": "MASS Logger", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "037872ace23d40cea90a72bf86391a9a", "type": "md5_hash", "threat": "payload", "malware": "MASS Logger", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "936f004ac961578281212bcbc8a2b86174cdfc9ef9ff5130a37339f08bc95fc5", "type": "sha256_hash", "threat": "payload", "malware": "MASS Logger", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "af4968799e6ec68e857321303bd866304fe1fcb6", "type": "sha1_hash", "threat": "payload", "malware": "MASS Logger", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "2d8e579b7991a5520ee6b72db2d1856334c845eaac2ff34ae1940195d4e656c9", "type": "sha256_hash", "threat": "payload", "malware": "MASS Logger", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "07e7a049b8ab970d939bfe70b4823a3d", "type": "md5_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "9a25d6a22155cd7d35b43e7395786c94", "type": "md5_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "5cb6f1ea503fdd8869cadce144f4b215b48cd395", "type": "sha1_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "a6302dc1b92419016fd3f73ab33a08c1ab7a3c9f2f51a5d2e397881bfa02f007", "type": "sha256_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "a9daa946ff08e4038a183f4af6a23b770a23ed9147d02a5105483a517b075de5", "type": "sha256_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "d3bb25ff6774e40decff40e3c5b4c14f6df1e8bf", "type": "sha1_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "32278911f2fc67e6a1f22bb00514f881", "type": "md5_hash", "threat": "payload", "malware": "ValleyRAT", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "fb94f4a579923892a9a941615a4e40363aa4051b", "type": "sha1_hash", "threat": "payload", "malware": "ValleyRAT", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "fad01dc36690d88a659f95817f93b3bdaed57b9371e5fa1eaf0024f8eadcf50c", "type": "sha256_hash", "threat": "payload", "malware": "ValleyRAT", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "9d898208f82f6960dd8cf93cbb5f7d7d1a3402dbd9fab8f3ddbafc80c7f4defa", "type": "sha256_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "97e4461e3f05aa7c6a2ba29c667b06fd", "type": "md5_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "366e0ab1b764a02e1918c6ed456fa61476eb91c2", "type": "sha1_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "455406e2aa876b9c228ca32ace74579fc7e50b88", "type": "sha1_hash", "threat": "payload", "malware": "MASS Logger", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "0cb8c1a0b28d3c178c223dd34f292ac9", "type": "md5_hash", "threat": "payload", "malware": "MASS Logger", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "5e35fd45ab14b2936cf8a84f7755414759ba42f95e7a22b6889e499cd1a5787f", "type": "sha256_hash", "threat": "payload", "malware": "MASS Logger", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "550cc29b57632760c11f093d892639a9", "type": "md5_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "aa88f2c3dc55df708af6e03736e137314d7f9f1d", "type": "sha1_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "8d153a2c0ba09344baaffa7fceeb6f4064d2bafb", "type": "sha1_hash", "threat": "payload", "malware": "CrossRAT", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "ea161f246655324da6e7d4d1ee6593fe516767e86f3cbd9659194f42ce0f0340", "type": "sha256_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "ca2abc916e3dcffc285c45ff2d80c4ec", "type": "md5_hash", "threat": "payload", "malware": "CrossRAT", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "133624990e62728737b31d58ade5562b", "type": "md5_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "24a6ed8ce6aa9fb2c29a706882efd3f3e1dec98517fc0e50b36a09543b6c69e0", "type": "sha256_hash", "threat": "payload", "malware": "CrossRAT", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "24c149ab38f3b85064a1f2b046824da1cb3d6053", "type": "sha1_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "297c9bb0dd3008f50d9b0b7f45ed6873abacbd37890b61cfc5d8ec3bbc731746", "type": "sha256_hash", "threat": "payload", "malware": "stealler", "confidence": 95, "first_seen": "2026-11-13 12:27", "source": "ThreatFox" }, { "ioc": "mofa-gov-np.donwloaad-file.org", "type": "domain", "threat": "payload_delivery", "malware": "SideWinder", "confidence": 100, "first_seen": "2026-11-13 12:26", "source": "ThreatFox" }, { "ioc": "https://gitlab.com/ntaylor6960/dwnlnk/-/raw/2806c0be90c552b60d559642f0c50f098c60ccbb/Installer.zip", "type": "url", "threat": "payload_delivery", "malware": "RevStealer", "confidence": 90, "first_seen": "2026-11-13 12:17", "source": "ThreatFox" }, { "ioc": "http://213.176.73.131", "type": "url", "threat": "botnet_cc", "malware": "SmartLoader", "confidence": 90, "first_seen": "2026-11-13 12:17", "source": "ThreatFox" }, { "ioc": "https://gitlab.com/ntaylor6960/dwnlnk/-/raw/b5fe3195445d5de183ee9af3b289eeb0cbd9ffdd/Installer.zip", "type": "url", "threat": "payload_delivery", "malware": "RevStealer", "confidence": 90, "first_seen": "2026-11-13 12:17", "source": "ThreatFox" }, { "ioc": "proxy.proup43.lol", "type": "domain", "threat": "botnet_cc", "malware": "RevStealer", "confidence": 100, "first_seen": "2026-11-13 12:17", "source": "ThreatFox" }, { "ioc": "https://gitlab.com/ntaylor6960/dwnlnk/-/raw/3df34c7f1f9b30ef97403f50a8da1212cb8b84c6/Installer.zip", "type": "url", "threat": "payload_delivery", "malware": "RevStealer", "confidence": 90, "first_seen": "2026-11-13 12:17", "source": "ThreatFox" }, { "ioc": "973ad2986d6eda8a8936342ba64fda6e2909cc8527a83bb2f474c13d76c0b6e7", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 90, "first_seen": "2026-11-13 12:17", "source": "ThreatFox" }, { "ioc": "b371d2e01562fc0d29072ac1a56969628b6408f2368c056c3158f4fe0c609960", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 90, "first_seen": "2026-11-13 12:17", "source": "ThreatFox" }, { "ioc": "2903e5e3363c1c15725a5343d31429490ce662cdc3df3c1f0dbf8ba7863aa4c3", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 90, "first_seen": "2026-11-13 12:17", "source": "ThreatFox" }, { "ioc": "e472b895f15e4e17d3d35102ac6bc3eba9f707cb1da95df3ac2e7e9113825e81", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 90, "first_seen": "2026-11-13 12:17", "source": "ThreatFox" }, { "ioc": "c6859833796f682e3598f65865a2853c3ecc118d7f2fb01defc24cf328e3ecad", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 90, "first_seen": "2026-11-13 12:17", "source": "ThreatFox" }, { "ioc": "sonrentino.club", "type": "domain", "threat": "payload_delivery", "malware": "KongTuke", "confidence": 100, "first_seen": "2026-11-13 12:17", "source": "ThreatFox" }, { "ioc": "2e3bdd68f85755b02caa42ec0228fb8a56c964479c4f085eae67569d67440e49", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 90, "first_seen": "2026-11-13 12:17", "source": "ThreatFox" }, { "ioc": "ov.apacu500.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 12:05", "source": "ThreatFox" }, { "ioc": "g7.anka69.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 12:05", "source": "ThreatFox" }, { "ioc": "maggiefrankcarrier.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "whcpower.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "toptierescapes.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "thetravelingnursery.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "thelisakingcollection.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "tehranifit.shop", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "spearphotographystudio.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "sappbro.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "rabattecodeforyou.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "physiovitale.de", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "petalsinplanters.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "paraderochalaco.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "pacificcompliancesystems.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "ofoghnursing.ir", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "notarkammer-kassel.de", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "muyuna-advisory.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "mopmamasllc.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "miraslawfirm.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "mhpfitt.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "lockettsmanagement.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "lentyadak.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "latortavaquera.com.mx", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "labrecordsapp.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "aplusdigital.ca", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "aridejunkie.se", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "ascendgrowthsolutions.net", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "baileyclinicalsolutions.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "barringtonsleatherandcrafts.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "bronzestudio.pl", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "cbesenergy.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "ceibainsight.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "chobesoltan.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "contractingwithanchor.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "doostshop.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "eninewlaw.ca", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "genesisaisolutions.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "luxeelevategroup.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "leviertransportation.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "abzarmamot.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "apexevstudio.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 12:04", "source": "ThreatFox" }, { "ioc": "92677afe65d089c8fe059f10a1a802cf4bfea82806c90241f988f74a0befee56", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 11:58", "source": "ThreatFox" }, { "ioc": "3414edf5896c0a8d67eed21d70d8f2b05d8f908ad2dbc98b5b081e48d0337799", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 11:58", "source": "ThreatFox" }, { "ioc": "e7f02b5473c0fc96399682035cb1b925ac7f49c270279e6671b1f157e1bb570b", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 11:58", "source": "ThreatFox" }, { "ioc": "6d620b9212ca7a78d8429c8a6954fca0f2432f30b4ac61237ab5b66e23993a1b", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 11:58", "source": "ThreatFox" }, { "ioc": "864c7bac9cc908a40a7381ed106caa7a51968dd8e0f8693fe288c0d0dd7e9e01", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 11:58", "source": "ThreatFox" }, { "ioc": "fccb5844e18ca17c199499160d8e9d0ebdc01fdbea85d5ff7a931c0c63435c78", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 11:58", "source": "ThreatFox" }, { "ioc": "9976b7aca704d1ef35571f3d73f37a6e220080c94eb19b795338f50be26b3f94", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 11:58", "source": "ThreatFox" }, { "ioc": "085199426e1164921801c270851558abc33894612f2cdd345071eee593bf76de", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 11:58", "source": "ThreatFox" }, { "ioc": "30b9566e156aa6c52986738fbd205f067153e59cc3f4e404a75dd58e1128b9e9", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 11:58", "source": "ThreatFox" }, { "ioc": "73dc25c95c5f4a518fc5fb95a2cab280e1ced2b7461124be196acf1222afb7c6", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 11:58", "source": "ThreatFox" }, { "ioc": "f219675a69bdf61a449c767502c528443e180359376d70f202ebfbbdb9018b19", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 11:58", "source": "ThreatFox" }, { "ioc": "www.avellano.com.co", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-13 11:07", "source": "ThreatFox" }, { "ioc": "gy.apacu500.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 11:05", "source": "ThreatFox" }, { "ioc": "apacu500.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 11:05", "source": "ThreatFox" }, { "ioc": "zagalou.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "tukwilahoa.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "thewebnest.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "thisisrasha.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "toktokshop.my.id", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "ybvox.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "xsurf.cl", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "xdzconcept.es", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "xaffiliate.live", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "wisdomplatoon.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "wintiamemoirsfilms.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "wholesalecustomboxes.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "wgarnku.pl", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "wendyzapata.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "wellnessproductreport.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "weburl.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "waterfrontsmiles.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "wamansn.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "vorsutus.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "vlanduk.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "vivahouse.biz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "vitalflavours.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "veri.dental", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "veggi-water.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "vdarchitecte.ch", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "valtrioninternational.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "vallerh.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "umeedesehar.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "umeedenoor.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "trainvisionstudio.hu", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "selfshinestore.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "sehatmandpakistan.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "segahk.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "seethisart.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "satprabhavahealthcare.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "theshreeindustries.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "theninetenth.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "thegaurav.xyz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "theawesomeapps.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "terracegrill.pk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "technicalnews.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "tatwir-foundation.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "tampasbestdrivingschool.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "talktovig.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "supermarchemontreuil.fr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "sunshinesnest.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "sunshinecabrental.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "stateaire.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "ssvcngtesting.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "sssolida.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "sroyatraders.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "solidbaseworks.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "solacehillsdetox.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "smartpressbd.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "sindpdal.org.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "shopshekell.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "shivtejbhel.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "sherazandco.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "sheffieldcircumcision.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "sepcon.com.pk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "propertyjotter.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "santanaferroeaco.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "sandtownlogistics.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "samsbridgellc.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "samiyar.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "sahityakalasam.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "sagimultimedia.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "s-bul.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "ruyabetgirisi.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "rotacoreltd.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "roofwithprime.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "rongbachkim6666.me", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "rnibape.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "ritzywebdesign.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "rikvip-39.net", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "rikamusic.co", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "riderstouchmfg.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "restauradordemotor.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "renobre.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "reformasripe.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "recipesforchampions.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "realizaconsorcios.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "rdloka.si", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "rdigigosolution.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "rakeshdigitalskill.online", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "rajaprinter.id", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "rackupsystems.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "rabbitfast.net", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "ptinfo.co.jp", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "pradomieldelrey.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "metronmet.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "mehranbabaei.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "megawin888.vip", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "medliningmachineworks.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "portuguesaenlinea.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "pindownloaders.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "piazzaentertainment.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "pcec.net.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "pardesia.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "paradisefoundcabuya.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "panda888slot.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "ovibet.me", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "osprvimaj.edu.rs", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "onfintechzoom.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "omnifivetech.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "northlands.edu.ar", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "niramisa.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "nidayecosmetics.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "netcat.cc", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "ndashes.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "namayaoilandfoodagro.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "nadtreatmentcenterca.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "mvloc.fr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "muxtex.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "mscconsignment.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "montrealtex.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "mondoportapichierri.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "modishglamspa.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "mnnow.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "missiononeusa.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "mirissasnorkellingwithscubadiving.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "mirahmetalfabrication.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "mexluz.mx", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "lubiworld.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "mazelfashion.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "markmann.co.ke", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "mannaa3.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "mameteo.ma", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "malibubeachpizzeriaristorante.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "malarpatientcare.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "madridadventure.es", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "machinesgeek.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "lstudio.com.mx", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "lpmadvisorsllc.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "lonsonpergola.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "lescobill.web.pk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "lerno-eg.online", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "lensapemburunews.online", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "lclodha.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "laserreix.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "landmarkbuilder.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "kovalammarathon.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "knowthepersonality.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "klikindonesia.co", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "kfeinabit.tech", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "kayakonariver.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "karmen.co.id", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "kalyaniyakavanagalu.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "justlikethatandmore.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "jurnalline.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "josemanuelcolsamaestro.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "jktronics.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "jimmysmokeshop.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "jbdl.net", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "jaam-immo.fr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "ismartgenius.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "iptv-subs.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "framesecho.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "fundacionleaencontexto.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "galabangkok.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "galfcare.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "gameb52.store", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "garagedoorrepairfortcollinsco.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "gayrimenkulliderleri.tr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "gbengaadeleke.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "gerakancintaprabowo.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "gestumsolutions.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "ghadtar.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "glaishamarino.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "glgraniteworks.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "globopoprd.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "goglobalbd.net", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "goldenstatetix.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "groupe-estille.fr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "gtpuk.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "hairtransplanttraining.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "handynour.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "helenannlicht.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "hestico.co.za", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "hotelruralanzarote.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "hydra888.company", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "idealairconcepts.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "igenedu.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "imperial-impex.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "infomagazeen.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "injuryrecoveryhub.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "insight-es.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "inwellclinique.no", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "dubai3k.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "folha12.sampa.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "fmintl.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "fjftechnicalservices.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "firstcfos.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "filltheform.site", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "ffamousparenting.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "fekra-gallery.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "fefapimenta.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "favoritosdebelezabr.site", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "fastcold.us", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "fastabortion.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "farmingsecrets.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "familylegacy.cc", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "fairplayriverpark.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "faglobalenergy.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "expertrax.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "excelsac.net", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "ewishz.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "etincellelight.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "estudiomunuce.com.ar", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "estimationparis17.fr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "essiosdigitalllc.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "especialistadoamor.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "ertassomine.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "ershadulbari.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "eodtechsummit.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "emeksanati.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "elwoodinternationalschool.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "elearningausbildungsportpsychologie.de", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "eidin.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "ehrisw.shop", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "duwola.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "bornoporichoy.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "drsuryanshnemaortho.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "drivenworldindustries.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "drive4u.com.au", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "drdelavega.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "dprmodels.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "dosmundos.online", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "doingtimetransportation.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "dicasdaricafalsa.site", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "dialysealamal.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "dgbuildersgroup.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "daniyahkhan.info", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "damionjamaicatours.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "coquinacaninedogtraining.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "cooltechelectronics.shop", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "converzed.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "conquertechinnovations.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "competenssupport.se", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "communitycatering.ca", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "community-growth.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "combicraft.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "colonelsssbacademy.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "colegiopinomontano.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "cloudinfinitytech.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "climarmy.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "cheops-info.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "charleescharcoalchicken.com.au", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "chadormalusc.ir", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "cerluf.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "caringhandsmls.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "careeredu.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "canecagreen.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "cafaenterprises.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "bowvalleygardencentre.ca", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "bemeelectricalservices.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "bonadijital.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "bolognapharmaceuticals.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "bogatv.net", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "bnibusinessroundtable.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "bngamerica.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "bloomstore.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "bispnews.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "bipfencing.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "bionicts.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "biodexer.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "bhpdlegacy.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "bezonailbar.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "betmatiksitesi.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "beetrruz.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "barkatconstructions.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "banguproject.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "b52club2.dev", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "b52club-2.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "ashalaw.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "arrangorerinorr.se", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "arcatahighalumni.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "antaryatradham.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "amitsinghal.net", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "americanelitetopexperts.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "amecamex.mx", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "amazingcarehomecare.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "am-universal.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "alshoullasc.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "aliakbar.website", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "aldweryclinics.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "alaminuteinfo.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "abcnews.co.za", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "adnvce.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "agqatar.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "adobereaderdownload.net", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "al-oyoun-crans.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "ahsclassof1983.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "abceducentre.ac.ke", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "aarambhlegal.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "99appshop.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "91nutrition.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "103decor.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 11:03", "source": "ThreatFox" }, { "ioc": "https://virexontech.com/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-13 11:00", "source": "ThreatFox" }, { "ioc": "owqkoqoqoqoqoqqoqoo.info", "type": "domain", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 100, "first_seen": "2026-11-13 11:00", "source": "ThreatFox" }, { "ioc": "4832ee7225ed1d49af4604e39ca41465f6fed524642349c4cafcfa1eb03bb609", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 10:58", "source": "ThreatFox" }, { "ioc": "15f97ac71c17d65347c01e5c3e0bc5590e67812e313749c65858f70e2d6b7e5f", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 10:58", "source": "ThreatFox" }, { "ioc": "a7763a0a0cc4c90039e16b8151ea5edf2f8b86d45fdaed75af0d2d3872dad830", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 10:58", "source": "ThreatFox" }, { "ioc": "sonosarcsounds.com", "type": "domain", "threat": "botnet_cc", "malware": "NetSupportManager RAT", "confidence": 100, "first_seen": "2026-11-13 10:54", "source": "ThreatFox" }, { "ioc": "45.91.202.58:2084", "type": "ip:port", "threat": "botnet_cc", "malware": "NetSupportManager RAT", "confidence": 100, "first_seen": "2026-11-13 10:54", "source": "ThreatFox" }, { "ioc": "sonosarcsounds.net", "type": "domain", "threat": "botnet_cc", "malware": "NetSupportManager RAT", "confidence": 100, "first_seen": "2026-11-13 10:54", "source": "ThreatFox" }, { "ioc": "85.155.15.16:7007", "type": "ip:port", "threat": "botnet_cc", "malware": "XWorm", "confidence": 75, "first_seen": "2026-11-13 10:51", "source": "ThreatFox" }, { "ioc": "https://hskstrading.com/rec.php", "type": "url", "threat": "botnet_cc", "malware": "DarkVision RAT", "confidence": 100, "first_seen": "2026-11-13 10:48", "source": "ThreatFox" }, { "ioc": "31.76.64.74:9998", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 10:47", "source": "ThreatFox" }, { "ioc": "gepan.kaiketsu.moe", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:47", "source": "ThreatFox" }, { "ioc": "155.103.71.120:7004", "type": "ip:port", "threat": "botnet_cc", "malware": "XWorm", "confidence": 75, "first_seen": "2026-11-13 10:45", "source": "ThreatFox" }, { "ioc": "ekulu09.duckdns.org", "type": "domain", "threat": "botnet_cc", "malware": "XWorm", "confidence": 75, "first_seen": "2026-11-13 10:45", "source": "ThreatFox" }, { "ioc": "adnr61y8.gesra.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-13 10:35", "source": "ThreatFox" }, { "ioc": "bedrockcoalition.net", "type": "domain", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 100, "first_seen": "2026-11-13 10:26", "source": "ThreatFox" }, { "ioc": "deskharbor.net", "type": "domain", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 100, "first_seen": "2026-11-13 10:26", "source": "ThreatFox" }, { "ioc": "fortifivebackup.net", "type": "domain", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 100, "first_seen": "2026-11-13 10:26", "source": "ThreatFox" }, { "ioc": "fortifivemain.net", "type": "domain", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 100, "first_seen": "2026-11-13 10:26", "source": "ThreatFox" }, { "ioc": "nantifivebackup.net", "type": "domain", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 100, "first_seen": "2026-11-13 10:26", "source": "ThreatFox" }, { "ioc": "nantifivemain.net", "type": "domain", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 100, "first_seen": "2026-11-13 10:26", "source": "ThreatFox" }, { "ioc": "alertgolf.in", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-13 10:17", "source": "ThreatFox" }, { "ioc": "185.224.132.148:8585", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "145.63.138.67:8081", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "dns.timesyncserver-312453.com", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "securedoc.makeneg458.workers.dev", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "cdn-analytics-p53.makeneg458.workers.dev", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "linkrot.fypahedupal2-0maz.workers.dev", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "securedoc.mesuttgulerr573.workers.dev", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "sync-node-serv.com", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "cdn-analytics-3f4033.rosamariaeadeshtvfud.workers.dev", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "dns.cdn-syncnode-server.com", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "cdn-assets-api.cfchk902834.workers.dev", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "cdn-assets-api.makeneg458.workers.dev", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "cdn-assets-api.busykifukek2-8psk.workers.dev", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "cdn-assets-api.kessler-m88.workers.dev", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "a8f2aac37385.xyz", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "544504d7fe1e.xyz", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "kfkwrfdd.xyz", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "bestutyresdomaonupder.top", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "bestutyresdomaonupder.com", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "bestutyresdomaonupder2324.com", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "https://securedoc.mesuttgulerr573.workers.dev/?id=", "type": "url", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:13", "source": "ThreatFox" }, { "ioc": "https://securedoc.mesuttgulerr573.workers.dev/m?id=", "type": "url", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:12", "source": "ThreatFox" }, { "ioc": "https://securedoc.mesuttgulerr573.workers.dev/h?id=", "type": "url", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:12", "source": "ThreatFox" }, { "ioc": "https://securedoc.mesuttgulerr573.workers.dev/s?id=", "type": "url", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:12", "source": "ThreatFox" }, { "ioc": "https://linkrot.fypahedupal2-0maz.workers.dev/link?token=7157717581ca4e3dda83e418af25fa448fe98ed2", "type": "url", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:12", "source": "ThreatFox" }, { "ioc": "https://gist.githubusercontent.com/yegeqebige46-creator/b393f36b20ad8aeadcb8a80af70ccc09/raw/da03fd7f1ffacda970a1f3d345bdaeae8c6a7b43/gistfile1.txt", "type": "url", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:12", "source": "ThreatFox" }, { "ioc": "ab7a7a88a90d3c26df5be69a41d7bb9251defae4a057cf2d23bb9dbc22ec4c62", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 10:12", "source": "ThreatFox" }, { "ioc": "https://github.com/yegeqebige46-creator/qq/raw/main/update.zip", "type": "url", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:12", "source": "ThreatFox" }, { "ioc": "https://github.com/yegeqebige46-creator/qq", "type": "url", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:12", "source": "ThreatFox" }, { "ioc": "https://github.com/JohnDow22", "type": "url", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 10:12", "source": "ThreatFox" }, { "ioc": "2ca14ca257abab463641f49b757c8fdf322d32930d3acecfa2e3fb681b19ec3c", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 10:12", "source": "ThreatFox" }, { "ioc": "deertracksranch.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-13 10:07", "source": "ThreatFox" }, { "ioc": "c.antres138.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 10:05", "source": "ThreatFox" }, { "ioc": "110.40.129.156:8888", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 100, "first_seen": "2026-11-13 10:05", "source": "ThreatFox" }, { "ioc": "209fe78ebeb4e1d2a437c4833c455fe9e69c628ffc5b144ff93606afbec6b8c2", "type": "sha256_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 75, "first_seen": "2026-11-13 09:58", "source": "ThreatFox" }, { "ioc": "https://tao.eco.br/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-13 09:30", "source": "ThreatFox" }, { "ioc": "http://190.196.253.121:11137/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-13 09:19", "source": "ThreatFox" }, { "ioc": "http://115.51.42.161:51781/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-13 09:19", "source": "ThreatFox" }, { "ioc": "gm.antres138.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 09:05", "source": "ThreatFox" }, { "ioc": "1.15.82.253:80", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-13 09:05", "source": "ThreatFox" }, { "ioc": "1.15.82.253:8080", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-13 09:05", "source": "ThreatFox" }, { "ioc": "1.15.82.253:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-13 09:05", "source": "ThreatFox" }, { "ioc": "rte.anka69.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 09:00", "source": "ThreatFox" }, { "ioc": "e28e82012636099db0c190d96663f29dab77d08ce5139d811bb65f0c102032be", "type": "sha256_hash", "threat": "payload", "malware": "Formbook", "confidence": 75, "first_seen": "2026-11-13 08:58", "source": "ThreatFox" }, { "ioc": "27b2c6c95efb702a690b65863e149e1b621b724d69021dd2cae9619374e73153", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 08:58", "source": "ThreatFox" }, { "ioc": "b0ee9e2f31c63a5bb42017b0babace7b82f2f34fee519c05d182a258e718ade4", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 08:58", "source": "ThreatFox" }, { "ioc": "48fd47c6778dfd00330dd7993260528dfb17fd8bef2a58735ee4d5c1cdc4240e", "type": "sha256_hash", "threat": "payload", "malware": "Formbook", "confidence": 75, "first_seen": "2026-11-13 08:58", "source": "ThreatFox" }, { "ioc": "https://w1.antres138.org/c3/gate", "type": "url", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 08:25", "source": "ThreatFox" }, { "ioc": "cihqobpe.receivewelfarebenefits.com", "type": "domain", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 90, "first_seen": "2026-11-13 08:25", "source": "ThreatFox" }, { "ioc": "04e6f503542e4bcf0e8dc51bc97c9698f2c212c664549ebed225ca92e497dc1a", "type": "sha256_hash", "threat": "payload", "malware": "vo1d", "confidence": 75, "first_seen": "2026-11-13 08:25", "source": "ThreatFox" }, { "ioc": "5bc0839e87e68f192f90c6f2923bea7f739690a412b4b054118107c331119581", "type": "sha256_hash", "threat": "payload", "malware": "vo1d", "confidence": 75, "first_seen": "2026-11-13 08:25", "source": "ThreatFox" }, { "ioc": "https://api.globalgamingplatform.com/install_stat.php", "type": "url", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 90, "first_seen": "2026-11-13 08:25", "source": "ThreatFox" }, { "ioc": "https://cacaoalcazar.org/router/endpoint-core", "type": "url", "threat": "payload_delivery", "malware": "SmartApeSG", "confidence": 100, "first_seen": "2026-11-13 08:10", "source": "ThreatFox" }, { "ioc": "cacaoalcazar.org", "type": "domain", "threat": "payload_delivery", "malware": "SmartApeSG", "confidence": 100, "first_seen": "2026-11-13 08:06", "source": "ThreatFox" }, { "ioc": "https://cacaoalcazar.org/router/acl-client.js", "type": "url", "threat": "payload_delivery", "malware": "SmartApeSG", "confidence": 100, "first_seen": "2026-11-13 08:05", "source": "ThreatFox" }, { "ioc": "bk.antres138.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 08:05", "source": "ThreatFox" }, { "ioc": "e.anka69.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 08:05", "source": "ThreatFox" }, { "ioc": "anka69.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 08:05", "source": "ThreatFox" }, { "ioc": "gypsumkasbah.info", "type": "domain", "threat": "payload_delivery", "malware": "SmartApeSG", "confidence": 100, "first_seen": "2026-11-13 08:03", "source": "ThreatFox" }, { "ioc": "https://gypsumkasbah.info/identity/reset-layout.js", "type": "url", "threat": "payload_delivery", "malware": "SmartApeSG", "confidence": 100, "first_seen": "2026-11-13 08:02", "source": "ThreatFox" }, { "ioc": "https://locationdevoitureessaouira.com/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-13 08:00", "source": "ThreatFox" }, { "ioc": "https://myinternetdirect.com/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-13 08:00", "source": "ThreatFox" }, { "ioc": "https://st.fsyehm.top/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-13 08:00", "source": "ThreatFox" }, { "ioc": "https://corporate-housing.ch/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-13 08:00", "source": "ThreatFox" }, { "ioc": "85759826f998c687135fc8b6e728b2828d54df0d249fd994d54838394c0ba1a1", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 07:58", "source": "ThreatFox" }, { "ioc": "toolset17.tools", "type": "domain", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 07:48", "source": "ThreatFox" }, { "ioc": "prooutlet58.website", "type": "domain", "threat": "botnet_cc", "malware": "RevStealer", "confidence": 100, "first_seen": "2026-11-13 07:47", "source": "ThreatFox" }, { "ioc": "queue.prooutlet58.website", "type": "domain", "threat": "botnet_cc", "malware": "RevStealer", "confidence": 100, "first_seen": "2026-11-13 07:47", "source": "ThreatFox" }, { "ioc": "http://ssh-node.hrtb.wreath.website:8070/binarys/$U", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 07:41", "source": "ThreatFox" }, { "ioc": "uqm.antres138.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 07:05", "source": "ThreatFox" }, { "ioc": "209.151.108.73:8808", "type": "ip:port", "threat": "botnet_cc", "malware": "AsyncRAT", "confidence": 100, "first_seen": "2026-11-13 07:05", "source": "ThreatFox" }, { "ioc": "wcltransportation.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "wallspostmedia.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "wanderingnewlands.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "womenarisingfordestiny.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "web-portal.com.pk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "wellnessdx.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "widehomeservices.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "zriyasolutions.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "yogavibeco.space", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "xingmatai.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "vintagemalecelebs.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "vincentburnsplastering.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "villageofviscount.ca", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "victorfloors.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "veni-etinam.nl", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "vegandishe.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "uptownmarketingllc.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "upsbatteriespr.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "uplifting.se", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "tylerperrymerch.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "trinityoaks.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "trendtapmedia.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "trakcingdomain.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "tntparana.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "thestewardship.com.ng", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "theremedy.world", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "thelanguageduo.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "visionactivated.co.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "vrmrevestimentos.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "vyentra.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "thejoyspots.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "thegrowthmonks.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "theforge-wiki.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "theexpensivebusiness.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "tentedelarencontre.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "teeshirtate.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "story-tv.co.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "taybadates.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "swayamexim.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "studioaa.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "steelcraftdoors.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "stairwayhk.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "stabilimentoportofino.it", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "sscsrebrenica.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "southindiaagencies.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "soulstice.eu", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "soloinfo.id", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "smkn1-tapiannauli.sch.id", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "smartgoal.us", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "skfsteel.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "simvah.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "simtedu.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "simplychiki.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "silvernestmumbai.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "sikhrishte.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "shininbali.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "shetkarifarmhouse.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "servidofer.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "seahandco.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "scholarplanningusa.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "scenerydecor.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "sarconejewelry.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "sanjefer.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "sandhillsports.co", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "sancod.co.il", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "samsfitnessstudio.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "rwabts.net", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "royerbrothers.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "royalxcasinoapk.io", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:04", "source": "ThreatFox" }, { "ioc": "royal300.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "rotomoldeomx.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "roto-powder.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "rompikkn.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "rodwarnerbooks.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "rodolyubie.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "roamiestravelclub.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "rideemotos.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "ricarstatus.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "rfkicks.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "rezidencekukliny.cz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "retroboxhub.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "renascentventures.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "reelskin.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "reddrogon.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "redcapalf.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "recursosimpulsa.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "razzledazzleevents.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "raseguranca.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "rajlubricants.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "rageagainstthemachinemerchs.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "radencichsalmonflies.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "radarsumateranews.my.id", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "queennadiatv.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "prorefrige.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "prolificcrafters.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "profjsbrarinstitute.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "pre-rollmachine.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "prasunj.com.np", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "ppwatchsale.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "powertripmerchs.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "positivehopes.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "pointblue.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "pixelationdigitalmedia.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "ozonmart.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "pittnertour.cz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "pinnaclebuilderscontractors.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "pinewooddxb.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "phongkhamdakhoayduocsaigongocong.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "phishmerchs.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "pensepoupe.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "parqnet.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "paralelo23.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "pamodea.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "ontymdelivery.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "onliest.co", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "onebet1.vip", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "offspringmaternity.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "offigrand.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "oakschans.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "nurimportbd.xyz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "nuevayexim.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "nocatlanticpartners.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "nkplacement.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "nhabinhchanhgiare.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "ngesoengineeringltd.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "naxoraglobal.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "narcissus-gulf.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "mxdevents.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "mumbaihotelsescort.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "mughilansdentalclinic.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "metalurgicasantacruz.com.ar", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "metaltechegypt.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "mendry.blog", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "memariassociates.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "mayportoilandgas.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "mayaindiangrill.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "mayadeep.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "masterofpawpets.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "masesolutions.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "martinschindler.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "marita-helterhoff.de", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "maagnyes.id", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "luminarylearn.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "lucianapio.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "lorcaderm.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "loansconmichelle.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "litenglishers.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "lg-exch.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "lebistrotbucerias.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "latagupta.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "lapradera.com.py", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "laococoapc.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "landscapingemirates.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "laboonadventure.id", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "kuberfin.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "kniengg.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "kmitlalumni.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "klpipesurgeon.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "klamptek.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "kjtechsolution.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "kientrucabad.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "khairkhawarelieffoundation.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "keyviewproperties.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "kevinkirby.nz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "kalisleepcoach.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "kadapaoficial.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "juraeinmaleins.de", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "joelpetre.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "islamicdawahcenter.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "islamiccomplexdfw.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "iiskota.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "iocuk.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "investmarathi.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "internetinhindi.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "inspirationdb.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "insideborneo.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "inkballoon.us", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "ilyailyin.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "iglepidom.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "iepfadvisors.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "idlerengineering.com.au", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "ibseedu.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "houseonflintint.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "hoteldelriver.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "horizonborracha.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "homeimprovementaustralia.com.au", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "holycrosshospitalckm.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "hillside-haven.fun", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "hhcresolutions.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "hechvarietystore.com.ng", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "hechosconamor.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "heavyequipmentexport.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "hashe.studio", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "haderacats.org.il", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "graydevworks.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "gratefullywell.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "grannydeespierogi.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "goldencaretravel.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "globelinkuae.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "globalunitedpacificlogistics.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "geprevrpps.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "gameneverending.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "egreenvn.net", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "g2g1max.club", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "futuresongs.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "fruvision.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "frutonegro.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "framecollegeofpharmacy.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "flectik.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "fastattestuae.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "farwamarket.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "farmafappi.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "faredshehab.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "factsandfiguresconsulting.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "epsnetherland.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "enduracoatingsystems.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "elmuntasser.ly", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "elevatesolar.com.au", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "elearninginst.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "elaiacitychurch.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "edboks.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "droneit.ng", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "drift-net.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "dpttravels.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "domsil.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "divorceprolaw.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "dimpleaircompressors.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "digitalcg.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "digimehak.shop", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "deysessentials.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "developer-rony.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "detakpatrianews.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "dentalwebcontent.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "delife-eg.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "davidbetka.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "bodyvoicefocusing.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "brkphotography.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "brookvaletowtruckservice.com.au", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "buildtogetherproperty.mu", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "cadetsguru.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "campus2collegeabroad.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "canttfooddeals.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "capitalmultiplier.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "carolinaventurestudio.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "caseacq.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "casinos-luckyvibe.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "cdeflashcard.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "cdestoryland.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "cerrajeriariveramonterrey.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "chains-consultancy.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "cheapmmoshop.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "choeursdarthes.fr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "christianazenner.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "ckiservicios.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "coasttocoasttipis.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "codedigital.dev", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "coflix.com.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "conciliacionlaley.pe", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "cooperfaber.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "core-nets.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "cotizaciones.mexluz.mx", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "crosscut-carpentry.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "cupuladeleads.site", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "daftarklik188sbo.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "decaturblaze.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "altube.es", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "bobbyfarrellandsons.ie", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "blowouttaper.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "biodent.co", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "binsloomservices.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "bib-unna.de", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "beyourpeak.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "benefits4consumers.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "bansalandco.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "bangaliconnection.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "bandnegocios.online", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "bandaemerald.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "bakesbyleilei.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "baguinski.adv.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "azurterrabuild.es", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "aymantrading.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "awadhzeera.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "autoharpquarterly.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "authorkennethmagers.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "artindo.co.id", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "arthaweblabs.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "arnss.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "armughalwoods.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "arenasanimaltraining.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "arabhmc.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "aqdiamondsworld.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "anxofedez.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "antirayapkecoatikus.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "anicagikovska.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "analogcreative.com.au", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "anaheimmailnmore.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "americaneaglepackagingco.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "allwater365.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "airavathatowing.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "agapeinspiration.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "africamediationassociation.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "affohatchadedji.tg", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "addisonroofingcontractors.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "ad88.black", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "achakzaiglobaltradellc.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "789club8.app", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "3fingersbd.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "3dsieutoc.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "2dan-agency.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "10kgdc.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "1-s.jp.net", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "alishaikh.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "aldamanalmalaky.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "albertafingerprints.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "alaminfood.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "airmed.id", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 07:03", "source": "ThreatFox" }, { "ioc": "28f8fdc502d94b3d3aae6b61e14782ae6e94aa655731a40328452b1ccd30dbeb", "type": "sha256_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 75, "first_seen": "2026-11-13 06:58", "source": "ThreatFox" }, { "ioc": "41b554713f3a157b45e81d3196fdc766478369481cb243e0960aa228e75900f2", "type": "sha256_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 75, "first_seen": "2026-11-13 06:58", "source": "ThreatFox" }, { "ioc": "b85965fd05837835f8f36d825cb07eb4c83a492fbc642d6a28baa006fd100d0b", "type": "sha256_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 75, "first_seen": "2026-11-13 06:58", "source": "ThreatFox" }, { "ioc": "97c1b2309fb08cb03805404014de498926bdbad6304b13ac226d2defd9321b3e", "type": "sha256_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 75, "first_seen": "2026-11-13 06:58", "source": "ThreatFox" }, { "ioc": "0dccb865fd6ea565761ae3407f7e67dedc44acb59ec2568c1d26e002c8dd1e5c", "type": "sha256_hash", "threat": "payload", "malware": "SolarisLoader", "confidence": 100, "first_seen": "2026-11-13 06:58", "source": "ThreatFox" }, { "ioc": "154.12.93.116:39082", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 75, "first_seen": "2026-11-13 06:43", "source": "ThreatFox" }, { "ioc": "147.45.39.37:4433", "type": "ip:port", "threat": "botnet_cc", "malware": "PureRAT", "confidence": 75, "first_seen": "2026-11-13 06:43", "source": "ThreatFox" }, { "ioc": "vbnbuildings.ro", "type": "domain", "threat": "payload_delivery", "malware": "StrelaStealer", "confidence": 100, "first_seen": "2026-11-13 06:39", "source": "ThreatFox" }, { "ioc": "n5ht1wk6.cojo.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-13 06:34", "source": "ThreatFox" }, { "ioc": "bflgkza0.gerve.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-13 06:29", "source": "ThreatFox" }, { "ioc": "3k1qo64l.etext.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-13 06:23", "source": "ThreatFox" }, { "ioc": "www.social.pureweb.com.ng", "type": "domain", "threat": "payload_delivery", "malware": "StrelaStealer", "confidence": 100, "first_seen": "2026-11-13 06:09", "source": "ThreatFox" }, { "ioc": "w1.antres138.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 06:05", "source": "ThreatFox" }, { "ioc": "130.94.67.43:22", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-13 06:05", "source": "ThreatFox" }, { "ioc": "31.77.57.236:8080", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 06:04", "source": "ThreatFox" }, { "ioc": "89.163.135.20:3837", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 75, "first_seen": "2026-11-13 06:00", "source": "ThreatFox" }, { "ioc": "wuohzjgoj.localto.net", "type": "domain", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 100, "first_seen": "2026-11-13 05:59", "source": "ThreatFox" }, { "ioc": "7fdb1968e2250e20e0d073d905c7dd52614a9c26924e76d641e4030ed7e57637", "type": "sha256_hash", "threat": "payload", "malware": "ClipBanker", "confidence": 85, "first_seen": "2026-11-13 05:58", "source": "ThreatFox" }, { "ioc": "31.57.216.102:2404", "type": "ip:port", "threat": "botnet_cc", "malware": "Remcos", "confidence": 75, "first_seen": "2026-11-13 05:55", "source": "ThreatFox" }, { "ioc": "31.57.216.232:2404", "type": "ip:port", "threat": "botnet_cc", "malware": "Remcos", "confidence": 75, "first_seen": "2026-11-13 05:55", "source": "ThreatFox" }, { "ioc": "5.252.165.189:7007", "type": "ip:port", "threat": "botnet_cc", "malware": "XWorm", "confidence": 75, "first_seen": "2026-11-13 05:55", "source": "ThreatFox" }, { "ioc": "217.69.174.72:8823", "type": "ip:port", "threat": "botnet_cc", "malware": "XWorm", "confidence": 75, "first_seen": "2026-11-13 05:50", "source": "ThreatFox" }, { "ioc": "compasssummit.xyz", "type": "domain", "threat": "botnet_cc", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-13 05:31", "source": "ThreatFox" }, { "ioc": "1.15.82.253:9999", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-13 05:31", "source": "ThreatFox" }, { "ioc": "1.15.82.253:8888", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-13 05:30", "source": "ThreatFox" }, { "ioc": "49.234.39.80:5555", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 100, "first_seen": "2026-11-13 05:30", "source": "ThreatFox" }, { "ioc": "webnus.wiki", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 05:30", "source": "ThreatFox" }, { "ioc": "finbse.wiki", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 05:30", "source": "ThreatFox" }, { "ioc": "appvbe.wiki", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 05:30", "source": "ThreatFox" }, { "ioc": "biizce.wiki", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 05:30", "source": "ThreatFox" }, { "ioc": "bizpse.onl", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 05:30", "source": "ThreatFox" }, { "ioc": "crypst.onl", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 05:30", "source": "ThreatFox" }, { "ioc": "turbeb.onl", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 05:30", "source": "ThreatFox" }, { "ioc": "turbch.wiki", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 05:30", "source": "ThreatFox" }, { "ioc": "studub.onl", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 05:30", "source": "ThreatFox" }, { "ioc": "studow.wiki", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 05:30", "source": "ThreatFox" }, { "ioc": "metart.wiki", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 05:30", "source": "ThreatFox" }, { "ioc": "metace.onl", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 05:30", "source": "ThreatFox" }, { "ioc": "finefw.onl", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 05:30", "source": "ThreatFox" }, { "ioc": "crypub.wiki", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 05:30", "source": "ThreatFox" }, { "ioc": "appvbe.onl", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 05:29", "source": "ThreatFox" }, { "ioc": "clicus.onl", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 05:29", "source": "ThreatFox" }, { "ioc": "api.localhost8000.fun", "type": "domain", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 100, "first_seen": "2026-11-13 05:27", "source": "ThreatFox" }, { "ioc": "solanaboss.fun", "type": "domain", "threat": "botnet_cc", "malware": "Unknown Stealer", "confidence": 100, "first_seen": "2026-11-13 05:27", "source": "ThreatFox" }, { "ioc": "103.216.153.140:10086", "type": "ip:port", "threat": "botnet_cc", "malware": "kkRAT", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "16e62857cdd57ec1c8ce6c581c13dbd1dcca1362c61bda8b96be83b352fad20a", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "904546a6a3743c8fb9dbfc592956ac07f049c88ef0be8a24826ac4b7cfbc7a75", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "ffb8ed2f54a310a0238ed414a9eb6c4c07c29860d4d0056b9dc86b85d76ca599", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "212c7bd125ae9c825d8c6bba7d36dfaad5d15f2cc9dffc5733416dac18e40558", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "b84ccc136a5696d47b716f8dd7fe30310a46946bf3e1e965d561f0354ef12913", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "8b25d4e4e9ddb8cdede130e8c93f0e5a2b4c53397d902ae2a641066da569d400", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "d0f0dd6c92f6644ca3db23c753a777d9841ec7d29db433a528c88d941ab00e3c", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "7d0649430f9e179ae573bdd10692628833d9a45a3df0a403dc35e11744c87d07", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "4cbddbfdc2a2dc5111728db28806e1b74dfcd13bf0f56eee20d103fb67094754", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "softwaresetupwizard.com", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "64b028f94289d07fc246ca49ad77a5f59078c431ac318f37cfd9647495134bca", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "cf6406efd76392a54cb4cdf32324946f1706fa8579f4074e2c252f5f9fed7040", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "d093167ee24dcc77f7e78306053fce3f543b55e903d57c2bf37c1b5d0abd21a4", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "59fb5c00f5ca98cc7e22ba10c39708f1716820169680500749abf2990a21c6a1", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "2a22c1561e3a662e68d47823a49e8fae8f9dfc375a8f5e2271dbb901b3f9b3ef", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "f9ecdc0d003f5f17433f5368f93000ef3aac482a9a4b841a6bcee3b51c8b62de", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "20283adea70fa0db5a5c0234c47126afe0ab55ced4c72eaf2c25dd3c56818208", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "badb7d1d06839aaa47ca91cc56d557e5da5d87ccf290492ec81c2f0496d5e160", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "674a5ee1e4acefa4b441cac5eadb190b8c83cf7483f34e949c0377a82a52ef6f", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "ca1f7d008c3dcd970e98fc9ff1e75b3a093add3f1bcb2f48517fd9e8cab666df", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "024be58d44a6021ac78688a28023e9ba7caf2d6bbeec2682b6b89d7c30802cc2", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "abf343ee7267d17f6c114d2655c6aafed28bb06fa9696706e7c236b361ed416a", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "8c887cdc657e0f01f2951830af35d2412411acc1dd15e680ef4f3096e0c521e3", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "ae7e01f76f121dae9f7f2b0916032565af8358a1d08d2031635cac1f5366ce06", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "708358ae2752dcde2a33ec5d26405bb99e6c007d99c31b84a87e06608b738bbc", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "590d5ae6170473e39bea7fbdc7a6300eeb484100ee62c49b5b1d55ace3516f61", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "a221c8761fe264ffa953476ad0a23033f667a8c2c48eb43274d96e4ed208c23e", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "5e4d114f062725011acb64738f637e9bd639d72c3c479687ee37befefbf3616f", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "cc823b2c31ff127bcada873aa5d2d2549d2c69007e4e68313c00f3b29ffe3e6e", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "8f246de765fa2b641dbff27df8f010cbb6b1569b93cdb1f99cf0a7fa2d3010e9", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "cefd5427c84894ded7e81a63bc6776a99fa9f41cfee41f446bcf93e64d7cd085", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "c0faf4d7eef6aaa8d7839ab7db2ed4c0ee59e081f21b6cbe2746d3837a5398d8", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "6e112c6f95b5bbe30f433e51af92e18cd842b7ab14e097e9ffe616251fc3dfc0", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "06798dfc0620ce5e2980b6684d7037436e72320386f8171a7ca72decf0d2edf2", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "49f86fab5187b52502299431dcc008367549db6d70d8c93a9a70dc7ee030f8f3", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "6009158c61d0cecc3fd85e3a3b23e94ca79ef1524d6b749b24e9b52ff29c95ce", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "247e7753c25ff1f5571844cc97d73212bd23350bb29ed9a858e3d8949cc071ab", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "6a23ca969cd6fda74845171d937b4ccabf8c90bb1949843b73a176a16b4ef6bd", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "14d0844c048da69c9469e30179cf46f75766420cf0f303f7a990575b3957926d", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "25bb78acb7bb070aebbc6126a18eaa57150bb8764746433cf439c22f8f26228e", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "2613489dd5d8b31ae06ca954d405f9309d2385dfe927a05194e4c11af8ca3e9d", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "07311efd018bf94088ff514360eb35390d493f75ac5cad1ced7e9acd85c56b5f", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "a97958193a76fb9dd5f8c07e73f8a1b1dbb1a156d34ae00dd8cc4fa14b3cbf4b", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "0c99319f3c786c8c834db264847845658094817e646f3a8d7c34dce0ae65019c", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "6a85dc122b24578730b41fbab235e2278d400e10e8ec140eb29b6da403d22bdf", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "b73de00b2bbd45ab7491ae9c5a31f60aa4e42bd5d3025a47fdbcbb3cdb5c18c0", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "e786d9cf3e20b18c159e714cc601f296ffecb160e77acec63dc81cdb630dc426", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "e0a8bf4c4b7b274da79d4ce6142b923a4bfc8482d6c1f5a662cfb2382bf5ad28", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "doceditorinc.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "meal-formula.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "conv.doceditorinc.com", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "71656539cc644513396f56100ffb56f9ef9eaa5b7a16b0773d6e5d370a912a88", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "a799417bd79060d63e93682f339fbe2868de3881f9c5865d9b583f5b715c70a9", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "e7bc36c7345b3894bc1da3d18ff3dbf0a20713d17b93a585ac0da65776d29027", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "c21eb14ba63e943db5ea9ab64af02a50a17260c7d8538a133c4f6e0957d36f47", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "3c1dbc3f56e91cc79f0014850e773a7f12bbfef06680f08f883b2bf12873eccc", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "update.7zip.cloud", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "4ce5e5768d2f9f71e2835ab8ebc4a2191d436ca3a990a56e9bc264235c7b5b55", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:17", "source": "ThreatFox" }, { "ioc": "gg.afn360.com", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "fc10ff87b6fe2dcbeffe636c7a3ca85ce3da944c38c7ea08cd7e784c11fa0302", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "e7291095de78484039fdc82106d191bf41b7469811c4e31b4228227911d25027", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "3544ffefb2a38bf4faf6181aa4374f4c186d3c2a7b9b059244b65dce8d5688d9", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "b7a7013b951c3cea178ece3363e3dd06626b9b98ee27ebfd7c161d0bbcfbd894", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "https://wesleyjanitorial-doc-access.s3.us-east-2.amazonaws.com/Index1.html", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "https://smee-stanselmschoolphila-doc-access.s3.us-east-2.amazonaws.com/Index1.html", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "https://springboard-consulting-llc.s3.us-east-2.amazonaws.com/Index1.html", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "https://boca-grande-lighthouse-toffee-dcdd0e.netlify.app/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "https://tomihomes-com-doc-rfp.s3.us-east-2.amazonaws.com/Index1.html", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "https://thewildandfreecafe.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&t=wesley.doc", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "https://apslearns-doc-access-28da15.netlify.app/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "https://wocgranted.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&t=consultspringboard.doc", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "https://scjwc.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&t=smee.stanselmschoolphila", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "https://wocgranted.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&t=tomihomes.doc", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "https://rockymountainstoneart.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&t=Boca.GrandeLighthouse", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "https://rockymountainstoneart.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest&t=access.doc", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "aseguroremcos.duckdns.org", "type": "domain", "threat": "botnet_cc", "malware": "Remcos", "confidence": 100, "first_seen": "2026-11-13 05:16", "source": "ThreatFox" }, { "ioc": "locationdevoitureessaouira.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-13 05:15", "source": "ThreatFox" }, { "ioc": "ga888thu.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-13 05:15", "source": "ThreatFox" }, { "ioc": "use-opencode.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-13 05:15", "source": "ThreatFox" }, { "ioc": "help.xenngypt.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-13 05:15", "source": "ThreatFox" }, { "ioc": "reshow35.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-13 05:15", "source": "ThreatFox" }, { "ioc": "refract3.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-13 05:15", "source": "ThreatFox" }, { "ioc": "event.dis4cle.info", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-13 05:15", "source": "ThreatFox" }, { "ioc": "pfeefer.club", "type": "domain", "threat": "payload_delivery", "malware": "KongTuke", "confidence": 100, "first_seen": "2026-11-13 05:15", "source": "ThreatFox" }, { "ioc": "devpse.wiki", "type": "domain", "threat": "botnet_cc", "malware": "Remus", "confidence": 75, "first_seen": "2026-11-13 05:15", "source": "ThreatFox" }, { "ioc": "https://s3.us-east-2.amazonaws.com/applezncorrected/qotn144ybd/Dalfox-Bug-Bounty-XSS-Scanner-for-Web-Security-41734.html", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "enviar12-11.duckdns.org", "type": "domain", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "fortress.video", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "108.186.112.183:8041", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 90, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "http://www.web-cf-restapi.cfd/nz3eoetcdkkkzx", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "188.253.107.199:8041", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 90, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "170.39.213.151:8041", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 90, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "creativemind.website", "type": "domain", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 90, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "creativebackup.website", "type": "domain", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 90, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "relay.newmansamba.icu", "type": "domain", "threat": "botnet_cc", "malware": "Unknown RAT", "confidence": 90, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "6e6c1919fe960ccc265806de831006a68713ced68b4dd6ea3f59cdbe4dfa79fd", "type": "sha256_hash", "threat": "payload", "malware": "SSHDoor", "confidence": 100, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "120.193.9.169:22", "type": "ip:port", "threat": "payload_delivery", "malware": "SSHDoor", "confidence": 80, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "51.161.83.58:80", "type": "ip:port", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "95.135.181.84:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "95.135.181.84:80", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "45.83.182.68:80", "type": "ip:port", "threat": "botnet_cc", "malware": "Loki (Mythic)", "confidence": 75, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "115.190.241.51:80", "type": "ip:port", "threat": "botnet_cc", "malware": "Loki (Mythic)", "confidence": 75, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "89.127.235.142:80", "type": "ip:port", "threat": "botnet_cc", "malware": "Loki (Mythic)", "confidence": 75, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "154.12.94.78:80", "type": "ip:port", "threat": "botnet_cc", "malware": "Loki (Mythic)", "confidence": 75, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "193.24.211.237:80", "type": "ip:port", "threat": "botnet_cc", "malware": "Loki (Mythic)", "confidence": 75, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "150.241.69.22:80", "type": "ip:port", "threat": "botnet_cc", "malware": "Loki (Mythic)", "confidence": 75, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "2.31.47.224:80", "type": "ip:port", "threat": "botnet_cc", "malware": "Loki (Mythic)", "confidence": 75, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "http://www.crackingcity.com/VScan/dlIhost.7z", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "www.newzdex.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "piuifoasf.com", "type": "domain", "threat": "botnet_cc", "malware": "NetSupportManager RAT", "confidence": 100, "first_seen": "2026-11-13 05:14", "source": "ThreatFox" }, { "ioc": "antres138.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 05:05", "source": "ThreatFox" }, { "ioc": "mr.antres138.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 05:05", "source": "ThreatFox" }, { "ioc": "101.132.188.89:8084", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 100, "first_seen": "2026-11-13 05:05", "source": "ThreatFox" }, { "ioc": "https://sgm-holdings.com/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-13 05:00", "source": "ThreatFox" }, { "ioc": "tyroky.cc", "type": "domain", "threat": "botnet_cc", "malware": "WARDENStealer", "confidence": 100, "first_seen": "2026-11-13 04:57", "source": "ThreatFox" }, { "ioc": "ipest33.opik.net", "type": "domain", "threat": "botnet_cc", "malware": "LxBase RAT", "confidence": 100, "first_seen": "2026-11-13 04:44", "source": "ThreatFox" }, { "ioc": "45.157.112.131:43274", "type": "ip:port", "threat": "botnet_cc", "malware": "LxBase RAT", "confidence": 75, "first_seen": "2026-11-13 04:44", "source": "ThreatFox" }, { "ioc": "172.93.211.237:4524", "type": "ip:port", "threat": "botnet_cc", "malware": "LxBase RAT", "confidence": 75, "first_seen": "2026-11-13 04:34", "source": "ThreatFox" }, { "ioc": "49.233.150.149:7788", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-13 04:33", "source": "ThreatFox" }, { "ioc": "18.212.244.32:6286", "type": "ip:port", "threat": "botnet_cc", "malware": "Grandoreiro", "confidence": 75, "first_seen": "2026-11-13 04:26", "source": "ThreatFox" }, { "ioc": "optimus.homesecuritymac.com", "type": "domain", "threat": "botnet_cc", "malware": "Grandoreiro", "confidence": 100, "first_seen": "2026-11-13 04:25", "source": "ThreatFox" }, { "ioc": "https://vmi3747287.contaboserver.net/DZNmVsGRTNP03K.php", "type": "url", "threat": "payload_delivery", "malware": "Grandoreiro", "confidence": 100, "first_seen": "2026-11-13 04:13", "source": "ThreatFox" }, { "ioc": "https://vmi3747297.contaboserver.net/cOazpiuSuIkSqHP07V.php", "type": "url", "threat": "payload_delivery", "malware": "Grandoreiro", "confidence": 100, "first_seen": "2026-11-13 04:13", "source": "ThreatFox" }, { "ioc": "vmi3747287.contaboserver.net", "type": "domain", "threat": "payload_delivery", "malware": "Grandoreiro", "confidence": 100, "first_seen": "2026-11-13 04:13", "source": "ThreatFox" }, { "ioc": "vmi3747297.contaboserver.net", "type": "domain", "threat": "payload_delivery", "malware": "Grandoreiro", "confidence": 100, "first_seen": "2026-11-13 04:13", "source": "ThreatFox" }, { "ioc": "corporate-housing.ch", "type": "domain", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-13 04:08", "source": "ThreatFox" }, { "ioc": "g1.antonhoki.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 04:05", "source": "ThreatFox" }, { "ioc": "bl.anka4d.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 04:05", "source": "ThreatFox" }, { "ioc": "124.222.63.111:8084", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 100, "first_seen": "2026-11-13 04:05", "source": "ThreatFox" }, { "ioc": "https://marquesuaconsulta.blog.br/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-13 04:00", "source": "ThreatFox" }, { "ioc": "27cbdfda3b708313a39ee65deef296b43f878a2de34e619ae36f8499da27341c", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "7793b4d93f14515a6039d1e20f94bc531b2ea5cbbae3e3be0568b8614b851974", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "dfdd9325b008e7e968f99e2b07e15b9e4f4ddf337fb2d24c33b0a8fdd621b154", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "157eeef82857bc2557e935eac222295bf1be9db1ad236833bbc1023d50c25576", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "d29bc2c472f4ca6e809df308d5078ec4db8594fbcb373f69d9c47e69b7c9eb30", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "150c5a0b35351f3bfccfd318f7ab9d5d7fd6c2011a3b1fbb597d7d25fd7fe6d5", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "d39e712996b6134dc0bb7e2ef0f5c1055aac73e6a42b31ef3a5ea14c5a802928", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "193f017cacfd06384ed6e59e60a25ea5c6b529d57a64f1494d5fa0e7202e718d", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "25973ba55c2587117efcf6909df03cb78a480c3e5bfa158fa9ed8f6a114ca231", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "d360db3628dedeee92b09b57a7ee224482cb987eb55f61cdcaee5c501bfb36e9", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "61d723a5112a105ca3a008a8412b7d5d01c99aabd3e1a433f8f627df24f158d4", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "818cf7b27e038f246cbf96862826635d87a2689e5c74648257508275f7116368", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "d9c14a02e6510c6d4132c289fef0bba62a877308ecfdc5d266878e688cb3d33a", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "3ee230cb775f78dcaa807087cf2ff1fc30a47a6dac2b1a4c6dad277b4b1b340a", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "c172143fabafb95e01e8866b75ba15908cc05618a330613f33ef571783fc7ef3", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "454b322742c1e6d0350c569a1668dd5fad8516f267e5e7981408759d22c1ccac", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "f06336a5440913acc811a631a1298112983ac45d4f2b5932a8d079bc34c7a830", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "cacab963b325ab6693fdd586148e653e8a0622d7639bcbfd7e3de455bc9a3053", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "940c78785eea6222fdac8e8dab77eb5f34cd31c6cb6179bd578494ff6048c312", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "966fb1238f0c5d77dab8678977560b91c301faa6a04e8023483e0ac416d3c5ab", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "37ca4705ca853d94b8b71064b5a31c7b4316c0fc7c7d0566bd1574a6a13865e1", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "575d34124f2379e440130809a60635906b131344123451e35133cfc618ff3922", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 03:58", "source": "ThreatFox" }, { "ioc": "http://42.235.151.52:53354/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-13 03:19", "source": "ThreatFox" }, { "ioc": "http://175.107.2.198:55015/Mozi.a", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-13 03:19", "source": "ThreatFox" }, { "ioc": "http://113.205.186.170:52295/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-13 03:19", "source": "ThreatFox" }, { "ioc": "ngm.antonhoki.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 03:05", "source": "ThreatFox" }, { "ioc": "mtivn.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-13 03:03", "source": "ThreatFox" }, { "ioc": "8770d7626e3d133ab0322582e248ea1c83e7a0b4a66d7fc1f768dd8d7cbe1c6a", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:59", "source": "ThreatFox" }, { "ioc": "81ce3bfd0b0c1f1d37520322d88ab3bfcbf9fd1638653417b741d849d1c7dd15", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:59", "source": "ThreatFox" }, { "ioc": "65439584195b7957e4f6520502fe3f329c84cb1011fd1643be226d0c7ad411cc", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:59", "source": "ThreatFox" }, { "ioc": "981556d0e1516c36a002872030a9263800874c9ce43b07568f6d889669b22bfd", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:59", "source": "ThreatFox" }, { "ioc": "a1da7f730b6bb31f50372e4cc6829482ae5ec3cb7a2024431c3a5a542ec3d0bc", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:59", "source": "ThreatFox" }, { "ioc": "3246f0d2656913e27c3dda9fff972d10656e9ad1033910d61f8e933a5e216eb5", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:59", "source": "ThreatFox" }, { "ioc": "493b10bfab1ec10803c801fd55c0d1411f2e50965f89606440ea191d8812b731", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:59", "source": "ThreatFox" }, { "ioc": "2545bf2a32403e4a970f9725125d6ab8d188f9a0d783e6962beb21d93fbdf21e", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:59", "source": "ThreatFox" }, { "ioc": "a07ed93c3774cf6f39b6ca6b1964c5ac5278eb6d0b0ddb06d0a9c0502f92a571", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:59", "source": "ThreatFox" }, { "ioc": "6bd9e5228f5a7278247d8e4d8ab7f4cc09268b519d003a233c0a4f89ae266bf1", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:59", "source": "ThreatFox" }, { "ioc": "37679a4342348c2d89b8c77cf491d8c093b9e74c25d2eb67838d843233a4fda1", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:59", "source": "ThreatFox" }, { "ioc": "9166846c8e7cae8c926434668c4109c8ed65a0bd96026651c521eb0a58ab411c", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:59", "source": "ThreatFox" }, { "ioc": "05ee6e711a107b63e3d49989c00f3d268cfdde999b143011787dd234451a4e56", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:59", "source": "ThreatFox" }, { "ioc": "41f3323d69b0a147f0688273d734b68e798e12d63d2661e6d398e97c6159b493", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:59", "source": "ThreatFox" }, { "ioc": "5c0d415151a1e6d96478a9e1b50854a0b99472425d50a1d644809f3c5fd5d659", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "bbdce73682f4f4e4078a6e491bc0a9450e6dc15031ef27e340a7c032154f70e4", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "8880e8ec2d311e927cba27e3050ada0a61c589080313c4671d753bdd1b79dbbd", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "056ed0d77b60d4b8cbdc82b46b3980a15c4ceec534c95e1ee01a0c99ed504a75", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "b607eed8cd11e94e35b0a0a61bac8a4ab77f582ab3683f15c1a0e426f06a40f2", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "099f91db2989d7ec69c8ac470fecb47bd23683ac14625a57b3dacf5c093aa078", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "b40bbaa7cc934605302e0999a0028f54d924710143b319da72958ade46f19876", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "d99d47fbfdb9bc27b495be5646ab037027cba9b6af12b00391e465408e45d55c", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "533f59d72e5631d919522ff9e67ad3bec2fb7789915c923086c79ed131b3e9b7", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "68945f0148b9b16cc9f4d0dda5136be97549ee1770cd7d35c24514a73ccca097", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "add34a8a575c797a97ee05571f6e3b6d223c74e8de20bf87a5eb05c2c255039d", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "4eeab17660fcd828ab412ed24f79e483618f8e43ff244b35e2d65696743eabf8", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "8c43ce3ec6d53d55c688b8aa923260ed46b99a263acd552516ec39d01e888051", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "db5de5f7f7acbb9278d4cbaf1ecd4f4b9502772e59bade9574656f8015c918ec", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "822d3562d9721bf6a481bf562cdd4a75b3202cfab91c4fefc3afa6fd71619ae1", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "2a5b1e3eeb6f0d045517f6671e121f41ae766a36039f7e76a2c0782b8edd9409", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "ade94bc2793f334aa0ad0a7b2dbe13e81f82bfa5f4b4bec39f01cf33c6647b8e", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "ce652b153dfb8e72ff32ba272c0ec35ad6fb4254aeae7ba4bebb487b8041621a", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "028c50a7622b1101de1e0d4c7f0a285304e650dfb0d6cf710daac7b30ebb4249", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "d2f3b93cd2cd68d18f2bdf2553be98172376246dfa4fb5b6c500c93514bc5aef", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "2528a8a6729c2ea14b4f4235e6fbd52b802d02905052b5b3df9d3aa8e4eb9e0f", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "ba980c303bc22abb1823275c4539ee7e38f542d6353ea69888d3473a40294504", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "4dc8cd5e9c68cfb464bacc96aced7410e8bd22309e884de2c16cda00e304be43", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "de2f1805b14e98b9fede8cfde6f73d96da2e006de8d5e697960bebc6176cc0a8", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "3ca3a2e035f5d6a7d9766301168b4ccbbbaa4ab3e7145cb67a3876e2f28289cf", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "c0253c618143fa9e3f72f125dede51a4912fa49be138d5b4987f4a9277b8c871", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "91271f4b32305c7bbd01dafa45def06f5bfac3bb549d48eb779b4bc2ab71080a", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "0dce05695c28aeef15ebcab0dbc76262bbefec8100cc3bea40d13693ac5f9bc9", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 02:58", "source": "ThreatFox" }, { "ioc": "2z9voqdn.cetek.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-13 02:37", "source": "ThreatFox" }, { "ioc": "institutomapeando.com.br", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-13 02:17", "source": "ThreatFox" }, { "ioc": "boltonsongbank.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-13 02:07", "source": "ThreatFox" }, { "ioc": "kk.antonhoki.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 02:05", "source": "ThreatFox" }, { "ioc": "139.180.158.193:8080", "type": "ip:port", "threat": "botnet_cc", "malware": "Havoc", "confidence": 100, "first_seen": "2026-11-13 02:05", "source": "ThreatFox" }, { "ioc": "139.180.158.193:22", "type": "ip:port", "threat": "botnet_cc", "malware": "Havoc", "confidence": 100, "first_seen": "2026-11-13 02:05", "source": "ThreatFox" }, { "ioc": "391562fe691b6dcdeb06452bee45f17b49b3e5c62c72ddaa0c999721ce86319f", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 01:59", "source": "ThreatFox" }, { "ioc": "ce81b997031305d39cf50c2112cfac431852bde6dfa9b3f9db4ea4cb946691bf", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 01:59", "source": "ThreatFox" }, { "ioc": "d0587b78ad35407025814cdb782b5e29d68d3b3c1749869e0de1d4952d4ab757", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 01:59", "source": "ThreatFox" }, { "ioc": "104d750f4f7af30cf04388287d458bcb29e46f89e632f67cb33e3f9ec7aa55a8", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 01:59", "source": "ThreatFox" }, { "ioc": "414f90b2660b01d500c93194dcfffbf6fe2ecbde1da85de19f15bb0d536ec694", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 01:59", "source": "ThreatFox" }, { "ioc": "a6fb238a85b5da0462830c4afde9932fdf68b6d96c37b6259da1ed988fa2dad5", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 01:59", "source": "ThreatFox" }, { "ioc": "490a8b3c863c39510c55bb0cb28cdf5b023ad100929d55b1badf495e77fe7463", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 01:59", "source": "ThreatFox" }, { "ioc": "d4e7ab07f730f5d00a4f21d3870d388101385fcf841d0d57f1270e4f0fc45623", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:59", "source": "ThreatFox" }, { "ioc": "16ddcc3443ae34a94bdaec56bdd1a3825ae5890949699dee65a99919a14736bd", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:59", "source": "ThreatFox" }, { "ioc": "a4f3ea7d67fd04a30bb9a1891ffb21cd702ee020fe793823e54be62e2a85ca39", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:59", "source": "ThreatFox" }, { "ioc": "61cacc898851ab245f0e3ab6956d44bcebd2090a2e7860b85a287d740e65690c", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:59", "source": "ThreatFox" }, { "ioc": "cbe11f6a2efe05310677cb7e641117cb715e3ab2f7100c493fe847ca87e5ec9f", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:59", "source": "ThreatFox" }, { "ioc": "a77b7c128892f4be86462149cce4021e829fb33bb949cc80f22170a431761066", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:59", "source": "ThreatFox" }, { "ioc": "2e325b57ec6257086603014be2e271b0a6decf6418cf0e18d10e18a48a6bec96", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:59", "source": "ThreatFox" }, { "ioc": "3993b79227cd4d7ce8a37598a84d1f6319d48f75310856148eff10f5156d1875", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "02ef38789a2c3b5c1524cd6e8ad4619cc05e4378c88318c54164e88f417e590f", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "f34805091bda2f714ad04c56e74d11e37e9a04b2694d9f05775d4e4e5bb7b8fa", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "7d6e3b336bb2c76efae54d553a10e8259cac7cb3bbb87a050aec8100a0054d47", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "a7b65ff8648f2bd1297e70b133b95b6eb6cf42fe55d8170bfd21808a531e32bd", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "bb3f3162b46fe132ea986fd2d301a75188420d2e94c8e893d6891d55299c09ce", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "aabbd81276784ee1ce6dad29c56bbfedb073319c06aa0dfc02d73f5512aba8f5", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "d0c82bcd6b7f6b01427b379f6f1a8af05afbff9ddc74535972127c5fa35c218c", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "bf4824f7ad85d21d1f523268cc3e5919b22ff51c3c270de501eb95236f654562", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "665e303e23005dbd38304a43419c29ff62e918f7cea7249196963c0cb9fc0973", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "e1cb42dc9288bcd5f5b041ff4fb4d1ad1b211a4597910f42779c36a174d4998b", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "abb6009857c712bfd72f9b45177ac781a49074ff4b4727824876f3b8123623dd", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "782a2ebf9708bd45595e69b018b6873c8ef05865a00715a2b913889d77c0f023", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "d539f4613f15932213075e2839c4c6e318e602380aac43c0127b7a0ca6212a73", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "89d1edca78e6c192ad437c8bb695033864743373063dbde8dbf41a7884fc12ce", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "9704f0fd084cbff2b306ce08c24ec1b7bd5571d3a3b423aef03e4de0e28bbe36", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "6769be08eb771abd8c7b888a0c16f9dae366e8f634a5043fe694457962e1ce33", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "a0cbef50f581959395ea7fc9e438f677869611356b994868fc4f110e7ec5d68e", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "572032ddb59c4b89bdf730e0ddce2f13a4754b98eaab4f3b2d3c6d752f474f31", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "145cb37dd8bd04993fa0b3630d5ccbe525dc71172c901e352c0cf5d32d6a6fbf", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "9dd54358343d7839428a1face4ebb4e9812f6773faee1ef9e891d66427f9d673", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "333a1b08b69f4252f168c6615bd6df3974efc3d38be58e1eff0bff3ffcde954c", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "d44b98ce745f6e35a294fcfdb4ea8f60c8e1db24e27af6b97466f70cebd2f39d", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "a55b057a000d3323fd42cf8674ce3c44500b1b377e4df9ca1a02d18b957a3ab5", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "48c5f0b6641f70c95f48bf6684bd6f01334d045246b261a6ccf7cec2211c96ef", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "4870692a547836c03ede616bb3248fe595216afc790d2240bc738f588a9f53e2", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "2780e277ee890211a2d734c6b6882967fc232c7ff51a8e2f63a67ae5a77224d7", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "fcaeee5aa886371f1558386cb2d27e64e5a931c4df10a27430e34d270dc1cd2b", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 01:58", "source": "ThreatFox" }, { "ioc": "3b9d386885720b772a1d14b0f658201b35e74e4d13cac3a3a22c87bf99824493", "type": "sha256_hash", "threat": "payload", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-13 01:52", "source": "ThreatFox" }, { "ioc": "07gbnpr7.gedam.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-13 01:10", "source": "ThreatFox" }, { "ioc": "f76.antonhoki.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 01:05", "source": "ThreatFox" }, { "ioc": "122.51.215.90:9000", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 100, "first_seen": "2026-11-13 01:05", "source": "ThreatFox" }, { "ioc": "1ea78808667b496b5efa7f30ab0913b5757550594c9057b2fd0f079d1a31a915", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:59", "source": "ThreatFox" }, { "ioc": "96f355ec435f8b39f80e07419c1ddcc919ace048297528df197f0da68c7f93c0", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:59", "source": "ThreatFox" }, { "ioc": "0844fee1fa605745c4a3ef47319fddbc4d1724d5827889b9e62f38df19c5ec65", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:59", "source": "ThreatFox" }, { "ioc": "0cb7fb3df8c971467eaccc4a6befe978aeb7a66fd572c58540026eeeb7ab6f80", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:59", "source": "ThreatFox" }, { "ioc": "d94368314b3c21d004eaa7cc91dcce1fd682091d80906f2dee2cdfd937b62efe", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:59", "source": "ThreatFox" }, { "ioc": "8c81af7481cb9115208d03806ec8ad9fa423ef7ed0167a8d80eaed05f1dd6a92", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:59", "source": "ThreatFox" }, { "ioc": "d18fd755345f3b16ad84fbd39cbfad455d6609dd87ff26fe6f9b8cdb49c8a74d", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:59", "source": "ThreatFox" }, { "ioc": "2ddb21d9fddf33df00e8b3eb18d490f045df63c5e84cbbf07bee9ddaa81bdaec", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:59", "source": "ThreatFox" }, { "ioc": "b7ef891c6ea00eafc5336d624c520cb75848bec6ddf6f4807e4ab4cfeeb0db75", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:59", "source": "ThreatFox" }, { "ioc": "036b104b274835a3946447f467d99d422be362eff255b4fad09a07264f1027e3", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:59", "source": "ThreatFox" }, { "ioc": "703e177d124bad230c8937c41b026d24abd57299dcd65a3e75408a7c70afb3be", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:59", "source": "ThreatFox" }, { "ioc": "30cd817188fef3a84a39eefd5b583fed19f3de2fcd4a951887e554fe8a7449c9", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:59", "source": "ThreatFox" }, { "ioc": "9153aa230c1e3321d46f3b46a073a572cfdc42971ce00ed88697bc86ee52f884", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:59", "source": "ThreatFox" }, { "ioc": "58ffddf99027554d032a0af9b4a076fd44d063255363fb568e2e04bb6af3a500", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "bc0fce41f385c765c0c5e170a9eeae341b1b15dfce3b4268e35d8c08c079565a", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "089f0680c10baee84738549e07f80ff47792d4775df466fe3cd785e940d03324", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "3220dd4cbbddf23a9f2d8d1729ede101d4b31cc49a7f427215f4a5032222bf63", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "ba49248e5879de465d3cbd5d3b05fffa39fc82fb71cff00f2c27a6dd34f3f932", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "b1c842135fafa14bf7c5c0c4aa0a8410f1b2d01dc80fd5b439e00a631d63c11a", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "644666fdd1ac8d48b2da2e748071618d7b15775123fb9e4415983a20102fc492", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "fce50aa60ebdf3689d49d05793eb37357e4f7c79a6835ddfc7e8ee1ee2828ebb", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "2267e9622966d11d5674e8e6c67a6837ffea526ed515c0fc968ea197b652401f", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "3ec4e0fe5a9a6f1d364db3ad8cb3444c48b0c7101b01a7a1cb4b7f60a8a7b325", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "858b4b96d1796319b27cf6b482323dccef89db578208dd3cb33f70a45984382d", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "fbc9037df26b087c8f8144868d01be22e0d31a16d373df382ec3385f14603448", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "efc8ce0f49e7b2fa21c5a82555aaa9ee49a42d7b6bf40b317f57996da0dca126", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "22c92ed617ebcc267c3e32a79e1e53ed884b720da647608410430697880ae409", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "dbfdbee2d735719bfd3a3fb077bf835b8b68b7ca184660c3b89d3655c7aee2a1", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "e0de2aaac1147b7e3da1490d4ec553690c956e29ab6ad1143efc893c24526fe2", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "cb25eb75adaef0d1fb5aa774741caecb316eccf33d2fc6a5b3ba81d59c74d471", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "891ce5bb1c79fd9a63fb88a4a7153cf6d7484e3cf073b46e5f53d5657abe7098", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "e15077c1d7a0846047f49eacbc38496ead9e7d4209d387c3cf87951630e9e7da", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "ed2cce8ae5fe2c7fbed24d9a855975d7f495f39f5b8e2e4bfcbc1976d2502c8f", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "d3696a9fac04ca06a818d719e1e0f25fb5a74b9f27523d343c91c6a7e3c48143", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "dcd654bdf5cd8bb11dfa0049bc7428f57c2aa3899d52553f150440fbba4d2010", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "d08c9e36016ccd906cf2ec6af52da018cb477d8be074dc9c44d3cf53fbde2c54", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "4e6aed92e06ed56b3191ecb345f2ea96ac107f342f15adcb4be280e764647d7b", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "f08549fe4dcf373996dac61e6d9e0db4f836a9ef9e47b164b07031e3998c0366", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "76fab669cc3eb46204328033d9a9659e5ba8a3552f591c7aad2d0a7d61fd3c79", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "496920cb2b04e218ce2c2f8754a8e4bde640d9c501f26b58782c4cb567c41b0e", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "2fb07d96121058a0a1d7d28a950e95246ed82f9d19cd0b112ae43c401aace8b0", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Stealer", "confidence": 95, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "667152a97289100ba488c08c150753e2574e0c957f7c0b1dc5dba68f93052fad", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-13 00:58", "source": "ThreatFox" }, { "ioc": "45.227.253.132:42643", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 75, "first_seen": "2026-11-13 00:45", "source": "ThreatFox" }, { "ioc": "209.99.186.17:34973", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 75, "first_seen": "2026-11-13 00:45", "source": "ThreatFox" }, { "ioc": "209.99.186.17:24123", "type": "ip:port", "threat": "botnet_cc", "malware": "Cobalt Strike", "confidence": 75, "first_seen": "2026-11-13 00:45", "source": "ThreatFox" }, { "ioc": "8ekmqofg.ebaz.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-13 00:22", "source": "ThreatFox" }, { "ioc": "ww.anka4d.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 00:05", "source": "ThreatFox" }, { "ioc": "e.antonhoki.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-13 00:05", "source": "ThreatFox" }, { "ioc": "116.62.222.192:8088", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 100, "first_seen": "2026-11-13 00:05", "source": "ThreatFox" }, { "ioc": "120.53.28.97:8085", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 100, "first_seen": "2026-11-13 00:05", "source": "ThreatFox" }, { "ioc": "8f24712af42d4aa63ec4d046765ade60b9935b61f559231b2b6354177a736fa0", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-12 23:59", "source": "ThreatFox" }, { "ioc": "5932d90c651c051965a45de30c7e129eb1ca70a63d34c40f5b34e3fcb3dab02c", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-12 23:59", "source": "ThreatFox" }, { "ioc": "9e569195daa88a853b796d8d13b951fde44a20d0a72055b4b4c2d423835ffc86", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-12 23:59", "source": "ThreatFox" }, { "ioc": "fbf840c60184d225c9b34b1820e253f1a720a3ef316e3ca3322bb47f3a02e33e", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "85e80f44f1bc2997105e2cc12863b62f81bad662bae34a89ddbee2559f098395", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "338f08979ad6495566d62c7a5bed28a442dd0dcb6078ab688baf5d44b5d0836c", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "8c92f9146ba770bafaa972add6f93c8ceb131d754fdf560cdf89ae0bd0c25ea5", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "c7634178f389c8189e6fdd477b1908b17949465e2935a454628baaf9c59229a6", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "84380ec74ea532e4b12eb959b183f573516619a8ecaa8539f319b2c23a0a1156", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "5cb2460164487ec61871f0007301fad48ce5f7efceb40cf93dcd68aec225c3e8", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "39c1f7c1282aca79d1758fc487b227ed7f83c68d1ae4f0f897b37e1089c7d230", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 75, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "b31b5b8702a402594886592629c312aa8c440307208b365ee4bdaafd3eee0b1a", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "93be0e4ba1c0c8b9d589bde0f9b623049bf5077cbc53a910e8617618e119a535", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "c39b74cc93eb04f7747374d78a9186f104cc9234e992edf36464a2bfffd2e672", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "6c1fe991ea2eb7e1aa742ff093f36b9cac7b22a6c187c41d8e877970f8ab2378", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "2253349bf91358a991193bccf070c2bf4adb63a6a0bbcd16b468bd295eec3264", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "57d586d16c5c6e9e88f6b48f42fe016a354fc5218f3a6fd20733ede194698bce", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "003843359f5358853a5613d644142b633e880472b158a4d2468bc4b4c09d50e3", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "153d9309960f60804b29215f52bb7fed03419e3f69d55db8025c822aa0d12ddb", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "0dc87725955b67c007fd3b2f4d16d0cd1ae1b94a7b09bf760f6dfc338b729187", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "c6f83712b5161eb0911effc01c2f5fb2b063328ccdeacb7b46cce471ac346a0e", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "116cc6dc0d6449c1ae52ec1fad976fbcefbf22a46e51fa97a454e0f4109eb7f1", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "3c0352f5e7bbcb802f01fb18c299c527abe721302969f9db988a67e0e7874930", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "5ec912ef5779720c6c3c9e44b5561fb855242eed0d349105d11846096cd78201", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "9e0cc23932ce4de40bfa437360ccd4afedee9c5c9154ae62bd155e4a93381b2e", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "08706aef6269613869aeb57dcc3708f2e890937aa9c38ed115408f8f18ac3b0e", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "e902b3f0228e18f4e8d3eaf999d43c7f6fe93a012d4aeeafe31bebe5f3fc6e25", "type": "sha256_hash", "threat": "payload", "malware": "Unknown Loader", "confidence": 80, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "1eaba93e79031f4402debb37e18cac5959a579e20d281566ce4df124c608b2fc", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 95, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "77682550aefde97b1fb4e6fdf5127d2bbd54ac00be2360b738dc4be82e745b55", "type": "sha256_hash", "threat": "payload", "malware": "Meterpreter", "confidence": 95, "first_seen": "2026-11-12 23:58", "source": "ThreatFox" }, { "ioc": "s5e7xnaa.celar.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-12 23:22", "source": "ThreatFox" }, { "ioc": "antonhoki.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-12 23:05", "source": "ThreatFox" }, { "ioc": "m2.antonhoki.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-12 23:05", "source": "ThreatFox" }, { "ioc": "34c6658f098861f216da6cc7ea5256fd1e028c8722739fe424d4b1b218fc434e", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 22:58", "source": "ThreatFox" }, { "ioc": "94056fbe7ca0b17ca124d386b925b983a0ad4a3d92765d8f58b1f685e5f7f596", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 22:58", "source": "ThreatFox" }, { "ioc": "4761fffd1dfd93762cb76ff92874b74beb3b0686daad360499ce9172399ecefd", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 22:58", "source": "ThreatFox" }, { "ioc": "1744765e072715681b7cc2289df5998a22a76967994297742096b3441323a3cf", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 22:58", "source": "ThreatFox" }, { "ioc": "6ace5308f7dbbb74e690461a52045c5b976c811014f33216c9c95e229a571081", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 95, "first_seen": "2026-11-12 22:58", "source": "ThreatFox" }, { "ioc": "b834bc2a2c14ad7ae30043fcb1f53a78f7cc069bb93c7e903006eb183c446222", "type": "sha256_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 90, "first_seen": "2026-11-12 22:58", "source": "ThreatFox" }, { "ioc": "d1f1e7613b9d6e10565cd9736fcfc5631f54291bfca49f011d402c5e394daa3e", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 95, "first_seen": "2026-11-12 22:58", "source": "ThreatFox" }, { "ioc": "d7fa54fc22418134af1b33b923d2a2d76e3ecf871e3dfd337b46d0aea7b1c066", "type": "sha256_hash", "threat": "payload", "malware": "RevStealer", "confidence": 95, "first_seen": "2026-11-12 22:58", "source": "ThreatFox" }, { "ioc": "81f44013765580486de77bead284d978da7f8c873873854c176873afc6f690ea", "type": "sha256_hash", "threat": "payload", "malware": "WARDENStealer", "confidence": 95, "first_seen": "2026-11-12 22:58", "source": "ThreatFox" }, { "ioc": "f16c65dedf8f35e58716c488393555564f076a6407636b1d691dc6674b5f4446", "type": "sha256_hash", "threat": "payload", "malware": "Coinminer", "confidence": 95, "first_seen": "2026-11-12 22:58", "source": "ThreatFox" }, { "ioc": "7cd2a351bf0f2cb30a144a98c8e903582b83d4ef5116786fb766e221a5d697c2", "type": "sha256_hash", "threat": "payload", "malware": "WARDENStealer", "confidence": 95, "first_seen": "2026-11-12 22:58", "source": "ThreatFox" }, { "ioc": "329a6bc97fe8a0151e3183e8670d478a3de377ed8998c542de4fc4f61880ebd4", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 22:58", "source": "ThreatFox" }, { "ioc": "20983573b840447e1aacd6d3f6dd240732b15037d268d6456f0d3c4ec5051cb0", "type": "sha256_hash", "threat": "payload", "malware": "Coinminer", "confidence": 95, "first_seen": "2026-11-12 22:58", "source": "ThreatFox" }, { "ioc": "3f64b0146b323c5716043360e84384a5a197a897f46088df93a910470a29e1a0", "type": "sha256_hash", "threat": "payload", "malware": "Nitol", "confidence": 95, "first_seen": "2026-11-12 22:58", "source": "ThreatFox" }, { "ioc": "alert.mintstack43.click", "type": "domain", "threat": "botnet_cc", "malware": "RevStealer", "confidence": 75, "first_seen": "2026-11-12 22:49", "source": "ThreatFox" }, { "ioc": "https://nexguard.pro/ae8ouxb9gx/d956316373920945", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-12 22:22", "source": "ThreatFox" }, { "ioc": "d8.antirungkad.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-12 22:05", "source": "ThreatFox" }, { "ioc": "85.189.58.158:808", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 100, "first_seen": "2026-11-12 22:05", "source": "ThreatFox" }, { "ioc": "9e4d9b4e604ec4505d6d142ad00a852de16a19ed45edf464162bf8fb59f53715", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:59", "source": "ThreatFox" }, { "ioc": "20d3eae62d2ef6cd9fb98843c17ef345ffe9bd8f144314153be8982024882d6e", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:59", "source": "ThreatFox" }, { "ioc": "48cf69edc2a57e130c8bac1abab7a14cd804f6aa4f70318943d3b1d12cb56658", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:59", "source": "ThreatFox" }, { "ioc": "48e10c2fcafc01eec15f84770ab377c9925f1342abcaf22706700be28b24a1b2", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:59", "source": "ThreatFox" }, { "ioc": "61706bb1ed1fb93d4fd00ee0748653e3e6b1eabe69a35503aafa37400d5a3a19", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:59", "source": "ThreatFox" }, { "ioc": "2bd7d0839ecc7a42223fc3ffb2ac336199dea4850f43c346628658f7584cb564", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:59", "source": "ThreatFox" }, { "ioc": "bbb35ecff02229ebd29f293e52e5d1c337b05e201f27ab225ab5b621bb9ce916", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:59", "source": "ThreatFox" }, { "ioc": "f5a3b29822dc0ce46ef23f646666b40ec30ee0c90c86f649c5942350812b73b3", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:59", "source": "ThreatFox" }, { "ioc": "3a3e2ae3f2a724b316be41e3b5c9556e2cae5dd8cc12dd5b1d4951615631fa1e", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:59", "source": "ThreatFox" }, { "ioc": "a91b09e4c1c8da3a982022f7a2a6d0c5579e83592877fb33b8811cb456a22121", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:59", "source": "ThreatFox" }, { "ioc": "1e7c5c92803c83d0b99a6fb3875ee89aa9ff5a07128c478740c73fc9aa0daa5e", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:59", "source": "ThreatFox" }, { "ioc": "35ffe9d2ed6d4b08eb96c64ae899917f101ca637012c2be5e42b7006fbd17c46", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:59", "source": "ThreatFox" }, { "ioc": "55ecc47e39a8a2217735339582159a24b5f9ccb547f4acc19f7dacfcef1dff86", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "682bf2b7daac966c7d8a90342efef261236da01b48cb66337c33f79ed59bf48b", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "9e668be9d2a776e819d1907777141cc437cb61885deb442bb82d91512e22d80b", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "700c366b32e298a1ed8737df67e7e1718d8240c32b5462ffd2bb0706e0dab2d5", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "fb96ef9610577c941c5c21ae605244d742bfe9ee927bf0c8aed96e19d677f3f3", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "255318dcd12c7ca01c1d61c731cdecc72d386e41f969721c943be1e04fdd85ef", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "61857cda3a961058a3fb39e287ccf9294edb42135a1379073b9cb12498d76cf7", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "8768bdcf7969dfba08a10b1044a6a8f1fe334caf3d2a7ee702150bd9f001a90d", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "1d24bb8cf4f3831d2f7cd5c2abfc587179497d9475c8108d7c91a1edc88653ba", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "53bb73b09ad2b09ac10bb4eae396b11b05d98e567bfdc84ab8816cfc57b3b6f0", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "58938182db09c2f84b32961b240d3d729ea67a2c2e6f85b406640e22ab7de813", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "7ca5c26f8d0821a268c2fa5726cac3ef06e461d95b962f466ed0a042b113f391", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "d2f6d4510d5d1ca3a5d062f5a4dfb20b4cbe3eb4d8450f494d59a45afa9a8a5a", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "6cca452153ead9416b1d8599757638d9d8c447f3f856e8a32644cf5ee25fab41", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "1577eefecdf712b5b7d4f2666ee3c7b47587380e6d13555aaac63445bbd7cfb4", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "cf9c199a737129f7f273db171948320ff1e605c74418596366cf6f13fbf5a9e9", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "34dd53fc4022fdf47928e22ce1e2d1f9df3619ce8027ccabd9fd1f946a632ffa", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "3f7d8fac9c2b89f315f94c538d15828002d9053da4d871b83d3a21fa46a1c7cc", "type": "sha256_hash", "threat": "payload", "malware": "Bashlite", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "d421ea33f2b56e665424dcb501dd4925fdf81307c94dc183a120886f6a978112", "type": "sha256_hash", "threat": "payload", "malware": "HijackLoader", "confidence": 90, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "8c0ca438c0809b37c717a8eb6c3d565b4147bf4ea97c05df6989909a798c9ef3", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 95, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "b483560be21a39860b6f1d14fdce20c58971b56c5877eee6992a8b7bc2c149b2", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 95, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "f208e22323d690f516a92c8de55b319d1904f57bf06d58a6e2633e217a9995f0", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 95, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "aa7d68624eb88508703ed8bab98c99ee05f689b328debdfe2f1b3504976f5542", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 95, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "fa0d4f7ee7b98832254aaac4ffbde039db206d61b6586cf054fced284233408f", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 95, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "98244dada836addb8910fdc27b155b97c4ba35c7d8e2098ed84f9df01ec0b7c6", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 95, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "bd402aa2ee74ee9c8f13d0250f0816b662a438de1df56480983628b2397eabc9", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 95, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "7d8e2ed973eccedea4a76edcdca0860b37dda12e27404da0520da32f0b74d937", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 95, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "2d1bf8db3a4c31b7a9446a8d5335b5a25bf836b27c1143617aa833163cfd8595", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 95, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "02ba7a3b56868a1c4b77bf946cbdb815fdc458080e84d33ece56df8ff7f214a6", "type": "sha256_hash", "threat": "payload", "malware": "JuicyPotato", "confidence": 95, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "3f61eca59a92f6737fe01a5ed5e2f184ebcc3a7720afc016e16727361dd36e08", "type": "sha256_hash", "threat": "payload", "malware": "Zeus", "confidence": 95, "first_seen": "2026-11-12 21:58", "source": "ThreatFox" }, { "ioc": "www.buzzdesports.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 21:34", "source": "ThreatFox" }, { "ioc": "dataset.ethack.slabs.dev", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 21:34", "source": "ThreatFox" }, { "ioc": "https://cleavesecurity.com/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-12 21:30", "source": "ThreatFox" }, { "ioc": "www.bravensinc.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 21:24", "source": "ThreatFox" }, { "ioc": "http://153.117.38.184:43785/Mozi.a", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-12 21:19", "source": "ThreatFox" }, { "ioc": "r9.antirungkad.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-12 21:05", "source": "ThreatFox" }, { "ioc": "83uae7er.garla.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-12 20:59", "source": "ThreatFox" }, { "ioc": "https://systhub.top/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-12 20:30", "source": "ThreatFox" }, { "ioc": "r87qvncm.dilma.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-12 20:11", "source": "ThreatFox" }, { "ioc": "www.altaibadates.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-12 20:05", "source": "ThreatFox" }, { "ioc": "valley-res.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-12 20:05", "source": "ThreatFox" }, { "ioc": "subhashini.in", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-12 20:05", "source": "ThreatFox" }, { "ioc": "save-meglobaltech.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-12 20:05", "source": "ThreatFox" }, { "ioc": "rebelsupply.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-12 20:05", "source": "ThreatFox" }, { "ioc": "oasisflproperties.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-12 20:05", "source": "ThreatFox" }, { "ioc": "hillorganicproducts.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-12 20:05", "source": "ThreatFox" }, { "ioc": "dolorsolutions.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-12 20:05", "source": "ThreatFox" }, { "ioc": "costaricaraid.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-12 20:05", "source": "ThreatFox" }, { "ioc": "adean.co", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-12 20:05", "source": "ThreatFox" }, { "ioc": "beajumper.com.br", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-12 20:05", "source": "ThreatFox" }, { "ioc": "aylwinimobililiaria.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-12 20:05", "source": "ThreatFox" }, { "ioc": "dd.anka4d.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-12 20:05", "source": "ThreatFox" }, { "ioc": "x7.antirungkad.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-12 20:05", "source": "ThreatFox" }, { "ioc": "aliu90ww.gamev.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-12 19:57", "source": "ThreatFox" }, { "ioc": "gamev.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-12 19:55", "source": "ThreatFox" }, { "ioc": "www.wholesalepetfood.ae", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 19:49", "source": "ThreatFox" }, { "ioc": "www.stivenbilservice.se", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 19:49", "source": "ThreatFox" }, { "ioc": "www.verdocup.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 19:49", "source": "ThreatFox" }, { "ioc": "185.241.208.246:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-12 19:49", "source": "ThreatFox" }, { "ioc": "webffoo001.cc", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 19:47", "source": "ThreatFox" }, { "ioc": "www.routedesmetiers.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 19:39", "source": "ThreatFox" }, { "ioc": "www.ramcoadvanced.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 19:39", "source": "ThreatFox" }, { "ioc": "45.138.16.246:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-12 19:38", "source": "ThreatFox" }, { "ioc": "147.90.182.32:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-12 19:38", "source": "ThreatFox" }, { "ioc": "278aedebe1f7e114e93e4f7e3cc5850f", "type": "md5_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "eed89aae8ebb205519c29913e0c3cebf4069f734", "type": "sha1_hash", "threat": "payload", "malware": "RN Stealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "35a3c714998539eb98a26e7ae58f379378ddf3fdcb67068944cc8c67a016eb04", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "4d2c3339e61f827a4fde503c775de9ec", "type": "md5_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "2742fa0a13c91283bdc9de21274c0c168a77a763", "type": "sha1_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "024d66b6e13ad1c4da253c72efeb6956", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "52e7dbe125b2d8db65a0ba7bf80aab698e7f54f8b5b51c2f218f5fb2870ed142", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "4a0540530a6674eaf7fb7e96f7a62311f9b1f078", "type": "sha1_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "cb7ffde3b9fcc7c23ebf88eed9a23967", "type": "md5_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "a4ec1bd1cc63c84caf9cd6feafd94259ac33aaac858e87dc47a583ed8c5f8c00", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "6b172831fa3a562a1da08d074df91d179224becd", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "1c4ad2a425a738a157fc81dfc68dcf32", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "41b94b182fb4221e3293ad488075f1623763bb56eeb2b19834730031c6081e76", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "5bc7f7052682611b52dccfb73bc628123ad4504b", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "63a457cc976840dbbf8b326896367980000be3dc", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "7ad21164b1638c58f1fb5beca8f87b27996970fe4e87244133223703d4c79aea", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "6ef196369eec61a0a1c23fa1cc6a0374", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "7b861d078d1e98069d1fcca68987fab4715d6542", "type": "sha1_hash", "threat": "payload", "malware": "Zloader", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "99548e2c8f4fc07379c2b32059e7f9f3", "type": "md5_hash", "threat": "payload", "malware": "Zloader", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "ab0b63f826e6cfbdf525d63f9f3811af", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "a1871eb203ab9137191fe77d01f9c34db383e197e22f5651ac0a98389a040674", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "9bed149e0d2cd335a95a9733675d0da61a2c7347", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "7ad0210242fdce5b7617f0a79069e85541f6eb0c798c5d888141dde2e07f065b", "type": "sha256_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "3a5492b2b40df6cd1bf5382bc8016490", "type": "md5_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "adcd061365be8816cc897e7cc47bbe80fcf5452a", "type": "sha1_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "426dd23dba6db7581e0fa8df2287f06c", "type": "md5_hash", "threat": "payload", "malware": "CrossRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "9cbcd25943a665af80396cd92ab32254d5b2d67a", "type": "sha1_hash", "threat": "payload", "malware": "CrossRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "6e359fe99f2c18567171140611aaba2e2926ea409036f30a76ec32f0e659da76", "type": "sha256_hash", "threat": "payload", "malware": "CrossRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "ffb21f95d31431580f61f5639b15a7fc", "type": "md5_hash", "threat": "payload", "malware": "CrossRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "6fdc1dbda23aaa71f457a893779bc52393a6f0b3", "type": "sha1_hash", "threat": "payload", "malware": "CrossRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "80bb151bc44c243cf6a62ebfd6852b74b385455a", "type": "sha1_hash", "threat": "payload", "malware": "CrossRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "91efb70dfac25b773386e4e4cb99cd88d2408e047f23ddaf62e1273105b2ee01", "type": "sha256_hash", "threat": "payload", "malware": "CrossRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "01b584cf4bfa2588685a9015e8aaddec", "type": "md5_hash", "threat": "payload", "malware": "CrossRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "404e8775cd5d42f4b79e5adc917364f30c3b9a17", "type": "sha1_hash", "threat": "payload", "malware": "ACR Stealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "b1d314a49440d00e8e1fc773bd018f3875e165200f867f688f869436b6178f7f", "type": "sha256_hash", "threat": "payload", "malware": "CrossRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "2991e31ba14d67d9fdf41557f932742a", "type": "md5_hash", "threat": "payload", "malware": "ACR Stealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "ca52a8272ad07c302836fe9c1166d0205ba7eda2da542c2645aa45c137fde2cf", "type": "sha256_hash", "threat": "payload", "malware": "ACR Stealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "3e8471c791f6b1154025406361a77810", "type": "md5_hash", "threat": "payload", "malware": "ACR Stealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "a06333cbaa5674e5c99bc20c2f38543a0b440578", "type": "sha1_hash", "threat": "payload", "malware": "ACR Stealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "10b84dd212e90e91c34bb62ad2b2e943f2324b5c5d24af767802415c54a56028", "type": "sha256_hash", "threat": "payload", "malware": "ACR Stealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "31ef622a831f07edcbbe80bcd07e0cf7", "type": "md5_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "16f3d3fafb915a47b482503db2540c153d7b3814", "type": "sha1_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "70a0c5754622533fe4fcefbf926670777097d9953681a884fc7adf6aa0a78809", "type": "sha256_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "666c7eef65f61054044ee416410f471a3ac2c4e0", "type": "sha1_hash", "threat": "payload", "malware": "PY#RATION", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "bb8011606fea0751304de45ccc422614", "type": "md5_hash", "threat": "payload", "malware": "PY#RATION", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "aedbaf7d4380ee4fd07c34017b67a0cf53eaf6668d37d45ecb8391130a039282", "type": "sha256_hash", "threat": "payload", "malware": "PY#RATION", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "7c641a6e87b670683ee09583db376e4d", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "cda61c2b19aaff17bd848b7c40d38eef81f08798", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "0a5cf9655d2470d95e76190534efdda021e43c43b0fcc7c340860b4e5ddc2cfc", "type": "sha256_hash", "threat": "payload", "malware": "AsyncRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "70644f33fdf61c5476004c61381a310475472adb", "type": "sha1_hash", "threat": "payload", "malware": "AsyncRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "0f673b1bcc497f14f2ae06205990fde9", "type": "md5_hash", "threat": "payload", "malware": "AsyncRAT", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "c8d12186715708c55096caca743983ddd399b526", "type": "sha1_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "271c82fcedf35dcd77ddafbfdd11ce1d", "type": "md5_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "680af28ceecc6c6c0f9d75707de8159a", "type": "md5_hash", "threat": "payload", "malware": "Phantom Stealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "26400d63a755cae8ae5516f556910d7ce74577aedbbe11ec0b9906e0f96d23a8", "type": "sha256_hash", "threat": "payload", "malware": "Agent Tesla", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "b6e6b60afc2c5f8006ae8d6754f62673f83fd937", "type": "sha1_hash", "threat": "payload", "malware": "Phantom Stealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "70aad4e38585ef2da66675d7253f2257d3843b4a6a5252ff5aabb264185206d8", "type": "sha256_hash", "threat": "payload", "malware": "Phantom Stealer", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "acb4549e0869982d01040d00089cb487c15c956a", "type": "sha1_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "6d6ccc83978ed37c0e37269aa3cab4a8", "type": "md5_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "79e0bb6ae090838c0e44763b43dfde23021fe6c9cee4b53efa8672cac6425a88", "type": "sha256_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "fffd069b093202819bb84ab5274acc4051b5cee2ded5286201b2342b260c4524", "type": "sha256_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "2438c92f9cd6a2c315d37bea8c61a63edd2d1ebb", "type": "sha1_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "7811a24af27bd5ef23f18f97c49ee0ac", "type": "md5_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "a11d325f5cae5d00c498c5b79aa39975", "type": "md5_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "9248c4d3cdf28743ac672169926b2ddd6606f2ec09dc0decc0c9756d0671820c", "type": "sha256_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "2d52adc8ed2a7cc77aeb22555937d9fcdf70dab7", "type": "sha1_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "bcead673c59140d3ca10b3e82cf5c1e7", "type": "md5_hash", "threat": "payload", "malware": "XWorm", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "1aaa1dc4b278bcee5ac65ba3ba6fc6f00d82a96e", "type": "sha1_hash", "threat": "payload", "malware": "XWorm", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "6025cc6c8a9d28d181d85978c7059bce526f25611aa53a63a4f1c1fe386157f4", "type": "sha256_hash", "threat": "payload", "malware": "XWorm", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "dc4c5a05b3b37dcca1ecd390f539c8fd6878e6c9d184beedf11943f10b494d77", "type": "sha256_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "d4689a806d7cde6b6438da001b677518", "type": "md5_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "f9db6b322382b9ec90eaf35a207207db22a1ce81", "type": "sha1_hash", "threat": "payload", "malware": "Formbook", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "e48605bd337407527bcc87def0ac355acf667bb1455ca41a740c874a68f729a7", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "fbc8d64fb6ebf56fb53a84a1211a2437", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "9cdcb2eca34baf033be3247f9577ff1f0650ff22", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "588165143cf4d4e914793253357c6cec", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "85bda8b665bcf5656fd52dc29469b3e391130855", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "27c4b0c00a94ba4b9ffeb33e13a68def1dcc9a4643e2b2e9c4b86f932945c0b6", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "d8bcc75badebb8d87459b552ae79a7fd", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "aef231418597f2fea6490246f395550fbc8ab36d", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "400e651df84721213d31718b1a25c982dc7017e1b2bcd98176268851784fcaff", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "68d14467867c5bad8d012df0ede7ed4b67dad5ab8c2745cba7d56d54cc349c63", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "2656085d8d4c035ff0be18c4ee542d20662cc568", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "0eb5d05d1fbea71169bae01962e78af4", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "6d5bea196a3d68b4cce14496685907db002ce9d1ac92671ef97a5d83e5c5c476", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "742f86dc12d1ecb8e5885bbe3658795e0bfe7be1", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "69984fa334063b265e01ee8af540cf31", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "f3d41c9e09457960839b47d75aecf9f7", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "782e0e1adf62b57635d2868bf871682a9e11a0fc", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "d5cf8ec693a1126663b155052dc6e7bad3771da591d5527f858bf9d885528bb8", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "b183e0d9284e8615f8581e03e5d063f3", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "9434603ec9f89a9bb108900e9c0b80a35cec8bb8", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "d9cbb80267a952285eb30d6c54e8dfce13ce6cff18cb9da0b832003f23f14be2", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "2480bdec6d29eab1a5fab5c658b922d1f333977f", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "3c9e499362f7784fd53a073e0eb0e248", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "ef3983ea1b702ecb60c5b61e5a6e42fbe2be947f30f81ba293b28e3ec75a50bc", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "10e5475d169d327b5e73e7880648cef9", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "6bdbc752ec6bba0269a8466c3ca11198bc9720f2", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "b0ccf6cc287b7f69c84a6f0dfbb63993", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "6c66522a8a7ba1e4e22072b9f43462c7c47b63e0ec8d85c828994c5b97502518", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:31", "source": "ThreatFox" }, { "ioc": "a26ca75e148618826d04c5b4f557cd52e87bfee2", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "2e702ccba0ee8e3e7adc2363b2cb55d2", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "71052fbd426deab850d1ee73f8afc6bffd5f707a7097a997aca4e1d720f00b0b", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "b114d1cb8d312870f450f6c6a0537e9dbe9fb9324b1002f5d5220639f47e6ef5", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "4ddffa10e9b3f108321911c0649046485a6496a9", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "c32f046b3fbdeb61222320a54db61341", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "fe5e68d537a92a51d664f8fb03767742", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "6e164ae5ea13c182e1b915571b5691e010da9f656780e7a050b3e6b7e6597571", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "895e62537597dfb19ef4a63fb1d3d7327c107aa9", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "e6886b1e36bac05abf1ad4281ac6d6c4", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "8fe4b520fb582a07c56dd01cb80686b5b84e4820", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "2e6224205e5eb0c22a1c5f2986955f264187862d", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "73abb0e39978910a9287ac7eca6dee0ff3b9e61dc304fbc9861a859f22ca6f89", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "b060772183438afc57e5eaf5768e9779", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "99089e395b3755ad73568d322b3ff1c685eaaecf", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "9750266017380fd1939fce8359f58e22d9bc8b4f5a9c06886cf460502912a031", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "f62344d9b0e8901ced60592bf88c0212bbe98ccaa88c12ea56cb45258a58a1e8", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "f6eb1dfe007d371c4d9814eb1bcf62b8", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "5c116be1f719058576e6dc2b0f815f7874b11ff6", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "e1a9d17f1e93aac95f2165b61537b604", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "aaa7b7998ddb5f19b6955ddc6bbd6f28dd55426b6d9d7ca59752396a3e0958f4", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "8bddd2eb1cdd0dac8f635cede2f4d80c376fb0ea", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "cfc402e0695c975f915c67751f16348c0553a7a1ba3d11941d83e15d8dbc4f07", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "b419f9b4d2e7aac2090ace5b110f3915bb3ed59018d2f6203760280f271c98bd", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "ae3c5bf53177e5499c38e473b2592245", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "5e7d0a77162fa3a4f5b6ba1f6217c7ce36f517fc", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "6d3447829cb39c15d51519990145ab06", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "37a83e1e9408f3048fde2c31b09a8df023d795ed", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "6b259335459c21b23d80648f42f60e0e482217bb", "type": "sha1_hash", "threat": "payload", "malware": "XWorm", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "0c6fe0739ca6942a806047d5bc9b19bc", "type": "md5_hash", "threat": "payload", "malware": "XWorm", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "fe29473acc64ce384efa0fa0c51df80f58e52d756fc913c0ea9c1d93b1e510a1", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "e1a4e75c2462833615beaacd014a9208", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "da46ac18b56b22f59219193edd2c04c91a5a791286926dfd768eda5109ff1c1b", "type": "sha256_hash", "threat": "payload", "malware": "XWorm", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "68cae1f5e3ed63bce68445cab1132d87", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "e763bdd0b5a169c490357e054853e2718d5b4c49", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "e4397b9672f08de023e657abf77e9aa783ce8cad4a2de2c055f0502137003c99", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "fb99f8f776a2d19d96f5ec3397c9ce13f6badfc0", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "ece8f22b59d0f86c7fc69a3f8f50a4b9405656f57f4faa34fa10154e928e7e83", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "f24683150418e964e2ae7715ac11cdcc", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "eed25f9f0744389048d5a388dcf9e21e7b344745cd55b766c3730567174f3389", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "16734e8bb7487c2f8be5c0437fb48d1938a5b4d7", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "c991971668a76519b820782c87f99547", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "0af5282708f6083ca96b8d648e7bc64303c7e4b5", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "a4a3216f84c68007d214f7b6db0e682fe180f125", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "4ea13a47e3cccd9bfec4f15ec4b92ce500b997b29c3dceb949a3fa6ec5f7574b", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "dfa60a37da895596362f44ae6d0bfe6f", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "cd588e5bf0fb600666b12e8911126bda2504edb7892e194be757651426b5be8d", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "a06d1841a4fd9cfe180f48bf77255f6c", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "2d1de6c43881c4dcf5afa764e6e79986", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "48ca290fb86bfdf8a4fecfa0a75827e4037a3f274b9510b5a286e1f2addddb54", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "eb9c09a80b9244f2b7cdfffc14e42a2836ec8641", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "6602a9646c6c0a2dfb2f12f917f1e1d358d3d7bbaa3a2bdd1152f92b5066cf8f", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "685bf095abefe7d2a8d73bc45a85916440e689f3", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "6b42a4e7a3105d748445281eb1a593f8eb3d8c2714af8fd7b3cbeba1c24a3b8c", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "e29723f64817e6e70b9d94574b1d9cbad659a565", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "0025c23cd9235e1aa72f12e1eba3bd2a", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "09882028e0247518bb1ac07ae54a7f7b98255376", "type": "sha1_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "a5891ece0c3eebfa9dee94d3bc1500c0", "type": "md5_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "bccbd191954073ea606a079584f1717c", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "978e2d88691605d1eb0e164be37666aff303888f84cf4aab65829202e8a49fe9", "type": "sha256_hash", "threat": "payload", "malware": "KAgent", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "dcf33df5bc2e6257c8a9c09b33665f61218617b7c2288228115af309135c8bfd", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "8f38d755d5def8948ccf6e1c2fabfb6a", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "ab49daecb4d643ee346a338f7127acecc69c599f", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "c542dcd01e3fa1ff942ac69aa67e36539186363f", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "f9581137521c0da8398e3b9a118f0a01", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "b99b85e7ea81b70d471c3bf8bc04f7c58ff24e929a5796837c86410df51c58bb", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "220e570178025b32a7c6b0d829375dec517cac4b", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "ac7d8f2d528301aa87d3d4a94ba178cc", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "ef3cae4959a7192672e2d3fafb444cf4ae03a21f4e84460d8414d99bf55ca268", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "ad1f6ce5d498160414a78393ac7affdb147d0bef", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "c1cce296b20dea08d1ba3cea15e9f949", "type": "md5_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "7405428549acc1ee26c1824f614040cdaf216ee1f742f28ecc0c5ed499eead45", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "a92ca96c97b02dbb0b74ff54747eb2828eff5640", "type": "sha1_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "5633ae45bbab392a695eae63cd57149b", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "b0a76ec7bb5def3d0aa5044d3676434b6a10a073abb05de10247c6706ee3bd46", "type": "sha256_hash", "threat": "payload", "malware": "NjRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "2556ded252ebc8f9f5893a4323f1ee9e41f5a560", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "5cdc7037bc1ef1595e65acecf7c3c29a2b0f0086aaaf94bcdf1e2231c64f9c0a", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "3b1aae0fea0e36cdb64cad72c1755734", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "6f738c4e04c51bd17d1d63ed3005e8ba02ab4701", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "d62ae1ad8e28df1e3d1455d1df95f75d677b5eacb5c5e40968e0e1f4a24220ae", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "9a3671cb261fbf8d7aa8e9c1f7c4be30", "type": "md5_hash", "threat": "payload", "malware": "kkRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "fbc01f37ef3df05e0fff2b22a8299f7fb713eeb6", "type": "sha1_hash", "threat": "payload", "malware": "kkRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "4a14475800b8ef11481d4a292d366342", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "c1fe56e2cfe0780f26f093c29244307fc265d21438c3ccdbbe8402568d13515f", "type": "sha256_hash", "threat": "payload", "malware": "kkRAT", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "c7be4469c53fce54d7afb0358913b3647b8b3193", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "584df8f6dacf0196bf31f182ae008f52cf81fbe9f95d04cb8d6fa4786c621e35", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "b637f8c0aa8a0ac3195f54d74111e845", "type": "md5_hash", "threat": "payload", "malware": "WannaCryptor", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "8f7d0b593a3467daa85231da46a790e569d0ca72", "type": "sha1_hash", "threat": "payload", "malware": "WannaCryptor", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "6d97447a29fdf3ae30835317997d79c3", "type": "md5_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "c95d33d89a1b1bf175a7a278cefd307ad396868b462d26ca25c3c75a282222c3", "type": "sha256_hash", "threat": "payload", "malware": "WannaCryptor", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "f7a75ee32d5af5bf02acc6ddba9b5d25e39c0c35", "type": "sha1_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "3d3951aee4507f59ba3f5059f741b87dfe237c06", "type": "sha1_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "a622e78b8d88d5911ecb17fdafbad214", "type": "md5_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "149f22c687faf7332e10000ca4e7f549ec5cf086affd2a7595e9535d9cca75b0", "type": "sha256_hash", "threat": "payload", "malware": "Raven Stealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "d9336b1e618b4838caf43809a23e258bb989c6a6", "type": "sha1_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "968586ba50eddb6199273c96f2db2b9d96b9203c291c4b8ade592ce08d73b576", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "ca7794a175ecaa49f7b470e88f6a36d9", "type": "md5_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "ff59ac565fd37305602a3055918679d72b60f834", "type": "sha1_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "67584b27bb4d302a661212c48012e7a7", "type": "md5_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "5b18360e1a66e445d2e9d885f089f6f731b71c9bf314e882df09c7b566f2b3db", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "735601e45960fba9af9308bb4028df62", "type": "md5_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "91c8356b7cc36580c0a8543fad06894b6686e402", "type": "sha1_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "b5e9cf94175d0539fe48fc1af05813e96ec8959919c367f5d0dcce35262f984e", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "b775d03d5f998b0016c446bb02d1a823", "type": "md5_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "e2f648876c1ef5ef755e8f9887f928689c519fc2eb79551273940d4765dfe4c0", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "e2be16a614813313f99a34e8706df5af75b560d6", "type": "sha1_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "b83ae8e98bc9aac4a696464a2717c8bf5dfe058b", "type": "sha1_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "89e54f74062df3980ae2ad5e32eb3f34763128b927f0de510cd32d0b3b41924a", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "9526602061d510865e6b19dbc2a93e0e", "type": "md5_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "75a327d72ce4984aeb1db3ee9a3b686a72ee02a81d6b71e6608d10e7cc37fbe3", "type": "sha256_hash", "threat": "payload", "malware": "SalatStealer", "confidence": 95, "first_seen": "2026-11-12 19:30", "source": "ThreatFox" }, { "ioc": "124.198.131.34:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-12 19:26", "source": "ThreatFox" }, { "ioc": "a4.antirungkad.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-12 19:05", "source": "ThreatFox" }, { "ioc": "chigwellhall.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 19:03", "source": "ThreatFox" }, { "ioc": "61e3d5824f6774751409577b1952efec8b8f658de291dd28b3b86b6a8169007d", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 18:58", "source": "ThreatFox" }, { "ioc": "selltrade.app", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:53", "source": "ThreatFox" }, { "ioc": "www.lavabotechnologies.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:53", "source": "ThreatFox" }, { "ioc": "www.maisonlagure.fr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:53", "source": "ThreatFox" }, { "ioc": "www.idealuz.es", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:53", "source": "ThreatFox" }, { "ioc": "www.meddkol.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:53", "source": "ThreatFox" }, { "ioc": "31.57.216.48:10213", "type": "ip:port", "threat": "botnet_cc", "malware": "CECbot", "confidence": 100, "first_seen": "2026-11-12 18:44", "source": "ThreatFox" }, { "ioc": "fripbrion.pro", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 18:44", "source": "ThreatFox" }, { "ioc": "mellow-whirl-vale-klui.pro", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 18:44", "source": "ThreatFox" }, { "ioc": "misty-badger-deothqueo.pro", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 18:44", "source": "ThreatFox" }, { "ioc": "prism-krolmskiaara.pro", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 18:44", "source": "ThreatFox" }, { "ioc": "quill-kraee-um2gf.pro", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 18:44", "source": "ThreatFox" }, { "ioc": "sainbroissilver.pro", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 18:44", "source": "ThreatFox" }, { "ioc": "www.manyteesshop.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:43", "source": "ThreatFox" }, { "ioc": "www.peteatwell.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:43", "source": "ThreatFox" }, { "ioc": "www.lillepsy.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:43", "source": "ThreatFox" }, { "ioc": "wp.digiliance.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "yenilerotoyedekparca.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "tuncayvardar.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "toldosconvencao.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "time2heal.ing", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "thepmhub.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "themusicexecutives.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "themcdonaldsmenu.ca", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "tehilimlogistics.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "tastynaan.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "tarsusnakliyeci.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "taqwatravels.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "tajmahalmytrip.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "superdaddy.co.il", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "sunzea.fr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "streameastcom.de", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "strawbd.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "stivenbilservice.se", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "stille-airconditioning.nl", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "srprecycling.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "sportixas.xyz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "sony-bplabs.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "wholesalepetfood.ae", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "wayne.edu.pl", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "voltcase.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "vistainitiative.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "verdocup.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "vendorhivemarket.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "vanessapilatesemcasa.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "vandacreative.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "uroojmovers.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "unisun-bd.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "umraniyetasimacilik.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "trattoriadelcorso.it", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "sacdilme.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "routedesmetiers.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "roomeffects.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "rockbottomrestoration.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "rising9mps.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "rezazamany.ir", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "reelflareworld.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "reelbaccarat.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "rareearthh.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "ramcoadvanced.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "pulumur-haber.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "pt-etp.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "prosportfocus.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "pressvion.xyz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "pressvion.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "pr-shigyo.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "porticciolowaterfrontcondos.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "safemobilityride.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "samsunevdennakliyateve.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "saminosnelson.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "slotroveronline.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "slotreeljournal.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "slotrealmworld.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "slotmentoronline.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "simalmetal.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "silifkeajans.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "sidoarjo.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "sickfat.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "shopreshift.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "shopdeltabar.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "sdelite.org", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "scbcouncil.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "scale2dach.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "ryobiregister.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "saborillc.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "mxplayersapk.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "poradnia-marek.pl", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "playvions.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "playboysaloon.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "placebopalace.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "pitainterior.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "pickworthenterprises.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "pharmaskillconsult.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "peteatwell.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "persembe-nakliyat.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "paulosalles.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "paradigmconstructions.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "ovakentlastik.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "nuttyjoy.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "nutrijacksonmendes.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "nhomcongnghiep.vn", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "nextgencasinoplay.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "nextgencasinoguide.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "newheightscs.net", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "mudra360.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "mrt-media-gmbh.de", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "moonknitwear.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "metaldig.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "meddkol.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "manyteesshop.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "makemohr.com.au", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "maisonlagure.fr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "lillepsy.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "lavabotechnologies.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "gruppoiuliano.it", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "lastjourney.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "ismailayyildiz.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "imisayurveda.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "idealuz.es", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "hotelbfine.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "honeydo4you.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "hastyhacker.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "hadiyaah.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "dpsbloomingbuds.ac.in", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "efekt.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "electricians-london.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "elitecasinoguide.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "freelancingpointit.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "gamblecrushzone.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "gamblesphereguide.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "edumensa.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "getalogonow.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "buzzdesports.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "aromatyzycia.pl", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "atakentlastik.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "bahcelievlertasimaciliik.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "bakirkoytasimacilik.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "arnavutkoysutesisatcisi.cyou", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "beylikduzutasimacilik.xyz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "antrapreneur.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "appampalace.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "casinovoltzone.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "casinovictorywave.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "casinoriseguide.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "casinolegendroll.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "casinoblitzzone.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "bullseyemovingcompany.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "bravensinc.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "blythwyattbudd.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "bluerock.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "blueprism-showcase.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "blueprism-showcase.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "blueprism-demandservices.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "blogserranegra.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "blindagemtrabalhista.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "biltapay.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "divinespacesbystudio88.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "diemaennersache.de", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "databreedafrica.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "darisenglish.xyz", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "clubedecompositores.com.br", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "climatisation-chadourne.fr", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "20wawo30.com", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "andan.com.vn", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "adultdeepfakes.info", "type": "domain", "threat": "payload_delivery", "malware": "Unknown Loader", "confidence": 100, "first_seen": "2026-11-12 18:42", "source": "ThreatFox" }, { "ioc": "huurdersbalie.nl", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:33", "source": "ThreatFox" }, { "ioc": "mientinhgiac.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:33", "source": "ThreatFox" }, { "ioc": "mstannyenglish.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:33", "source": "ThreatFox" }, { "ioc": "manalitour360.in", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:33", "source": "ThreatFox" }, { "ioc": "kbfoundation.org.ng", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:33", "source": "ThreatFox" }, { "ioc": "maven.biz.id", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:33", "source": "ThreatFox" }, { "ioc": "muslimwomencoaching.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:33", "source": "ThreatFox" }, { "ioc": "moriapneus.com.br", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:33", "source": "ThreatFox" }, { "ioc": "nmengineering.co.za", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:33", "source": "ThreatFox" }, { "ioc": "indoride.id", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:33", "source": "ThreatFox" }, { "ioc": "microcolsastorage.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:33", "source": "ThreatFox" }, { "ioc": "https://bakirkoytasimacilik.cyou/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-12 18:30", "source": "ThreatFox" }, { "ioc": "ismailylz.cyou", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:23", "source": "ThreatFox" }, { "ioc": "lipokon.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:23", "source": "ThreatFox" }, { "ioc": "healthyimpulses.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:23", "source": "ThreatFox" }, { "ioc": "kl-consulting.fr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:23", "source": "ThreatFox" }, { "ioc": "iqosiluma.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:23", "source": "ThreatFox" }, { "ioc": "marinc.co.ke", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:23", "source": "ThreatFox" }, { "ioc": "lincolnlandbct.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:23", "source": "ThreatFox" }, { "ioc": "mric.com.mx", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:23", "source": "ThreatFox" }, { "ioc": "mavilamba.cyou", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:23", "source": "ThreatFox" }, { "ioc": "kauailuxuryvacationhomes.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:23", "source": "ThreatFox" }, { "ioc": "infofranchise.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:23", "source": "ThreatFox" }, { "ioc": "mebymichelle.biz", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:23", "source": "ThreatFox" }, { "ioc": "metromerca.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:13", "source": "ThreatFox" }, { "ioc": "kirkagacevdenevenakliyat.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:13", "source": "ThreatFox" }, { "ioc": "maltepe-haber.cyou", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:13", "source": "ThreatFox" }, { "ioc": "isparta-eticaret.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:13", "source": "ThreatFox" }, { "ioc": "kartal-haber.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:13", "source": "ThreatFox" }, { "ioc": "livzeno.xyz", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:13", "source": "ThreatFox" }, { "ioc": "korgan-nakliyat.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:13", "source": "ThreatFox" }, { "ioc": "lifetories.xyz", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:13", "source": "ThreatFox" }, { "ioc": "kusadasimedya.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 18:13", "source": "ThreatFox" }, { "ioc": "l2.antirungkad.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-12 18:05", "source": "ThreatFox" }, { "ioc": "1d80331fddf9f2b14b636fc3f214cbac348892d8d033c23d9ae213e2b0777943", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 17:58", "source": "ThreatFox" }, { "ioc": "7792f7d53bb9bd6514a3555dd7e12c1b1508066869078168b8b6e1ad577e4527", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 17:58", "source": "ThreatFox" }, { "ioc": "www.databreedafrica.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:43", "source": "ThreatFox" }, { "ioc": "albarakahenterprises.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:43", "source": "ThreatFox" }, { "ioc": "harp360.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:43", "source": "ThreatFox" }, { "ioc": "www.electricians-london.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:43", "source": "ThreatFox" }, { "ioc": "www.climatisation-chadourne.fr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:43", "source": "ThreatFox" }, { "ioc": "www.diemaennersache.de", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:43", "source": "ThreatFox" }, { "ioc": "www.hadiyaah.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:43", "source": "ThreatFox" }, { "ioc": "harilgroup.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:43", "source": "ThreatFox" }, { "ioc": "greencitybecamex.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:43", "source": "ThreatFox" }, { "ioc": "seed.friedandfries.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 17:34", "source": "ThreatFox" }, { "ioc": "dome.friedandfries.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 17:34", "source": "ThreatFox" }, { "ioc": "inch.friedandfries.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 17:34", "source": "ThreatFox" }, { "ioc": "haberladik.cyou", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:33", "source": "ThreatFox" }, { "ioc": "golkoy-nakliyat.cyou", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:33", "source": "ThreatFox" }, { "ioc": "golmarmaraevdenevenakliyat.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:33", "source": "ThreatFox" }, { "ioc": "haberladik.xyz", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:33", "source": "ThreatFox" }, { "ioc": "habercaglayancerit.xyz", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:33", "source": "ThreatFox" }, { "ioc": "go.das-gluecksportal.de", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:23", "source": "ThreatFox" }, { "ioc": "canadagoosecasales.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:23", "source": "ThreatFox" }, { "ioc": "definitivehospitality.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:23", "source": "ThreatFox" }, { "ioc": "cuanvision.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:23", "source": "ThreatFox" }, { "ioc": "eventtechnik-mieten-berlin.de", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:23", "source": "ThreatFox" }, { "ioc": "eaglesfleet.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:23", "source": "ThreatFox" }, { "ioc": "gochinachef.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:23", "source": "ThreatFox" }, { "ioc": "dynorasolutions.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:23", "source": "ThreatFox" }, { "ioc": "elrozinteriors.in", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:23", "source": "ThreatFox" }, { "ioc": "dynastyjackpotcasino.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:12", "source": "ThreatFox" }, { "ioc": "dground55.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:12", "source": "ThreatFox" }, { "ioc": "cichepodlasie.pl", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:12", "source": "ThreatFox" }, { "ioc": "camillefarre-fleuriste.fr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:12", "source": "ThreatFox" }, { "ioc": "eczanedensatis.cyou", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:12", "source": "ThreatFox" }, { "ioc": "fortresssomalia.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:12", "source": "ThreatFox" }, { "ioc": "corebridgewellness.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:12", "source": "ThreatFox" }, { "ioc": "evdenevenakliyatmanisa.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:12", "source": "ThreatFox" }, { "ioc": "fatihtasimacilik.cyou", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:12", "source": "ThreatFox" }, { "ioc": "ekomera.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:12", "source": "ThreatFox" }, { "ioc": "gebzetasimaciliik.cyou", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:12", "source": "ThreatFox" }, { "ioc": "corazonmall.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:12", "source": "ThreatFox" }, { "ioc": "cord3outfitters.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:12", "source": "ThreatFox" }, { "ioc": "erzade.cyou", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:12", "source": "ThreatFox" }, { "ioc": "famelure.click", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:12", "source": "ThreatFox" }, { "ioc": "formulaire.objectifmaisonresponsable.fr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 17:12", "source": "ThreatFox" }, { "ioc": "in.antirungkad.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-12 17:05", "source": "ThreatFox" }, { "ioc": "https://decoupageguild.co.uk/", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-12 17:00", "source": "ThreatFox" }, { "ioc": "0af65ff826401fa4f7e53c394f0bc92fd427ad7bdd60a49a4ee2768332705aea", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 16:58", "source": "ThreatFox" }, { "ioc": "408adad587225367ebef9245d5e43126c93aac115468a439f36327f24a055f91", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 16:58", "source": "ThreatFox" }, { "ioc": "d2a996d2ba69227ba3cf470fba5de84cff7de89f31c9b74c5e90c74450f97d16", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 16:58", "source": "ThreatFox" }, { "ioc": "cayirova-web-tasarim.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:57", "source": "ThreatFox" }, { "ioc": "fatsa-nakliyat.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:57", "source": "ThreatFox" }, { "ioc": "digitalitglobal.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:57", "source": "ThreatFox" }, { "ioc": "canakkaleevdennakliyateve.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:57", "source": "ThreatFox" }, { "ioc": "drogowa-pomoc-warszawa.pl", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:57", "source": "ThreatFox" }, { "ioc": "datapressos.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:57", "source": "ThreatFox" }, { "ioc": "dailvion.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:57", "source": "ThreatFox" }, { "ioc": "decoupageguild.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:57", "source": "ThreatFox" }, { "ioc": "64.227.23.225:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-12 16:48", "source": "ThreatFox" }, { "ioc": "64.227.167.254:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-12 16:48", "source": "ThreatFox" }, { "ioc": "519trguq.gorti.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-12 16:47", "source": "ThreatFox" }, { "ioc": "gorti.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-12 16:47", "source": "ThreatFox" }, { "ioc": "70.36.127.16:56003", "type": "ip:port", "threat": "botnet_cc", "malware": "PureRAT", "confidence": 75, "first_seen": "2026-11-12 16:45", "source": "ThreatFox" }, { "ioc": "64.227.5.124:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-12 16:45", "source": "ThreatFox" }, { "ioc": "85.122.114.16:8001", "type": "ip:port", "threat": "botnet_cc", "malware": "Aisuru", "confidence": 100, "first_seen": "2026-11-12 16:45", "source": "ThreatFox" }, { "ioc": "5.175.169.98:443", "type": "ip:port", "threat": "botnet_cc", "malware": "PureRAT", "confidence": 75, "first_seen": "2026-11-12 16:45", "source": "ThreatFox" }, { "ioc": "45.76.144.224:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Sliver", "confidence": 75, "first_seen": "2026-11-12 16:45", "source": "ThreatFox" }, { "ioc": "37.244.241.170:4433", "type": "ip:port", "threat": "botnet_cc", "malware": "DanaBot", "confidence": 75, "first_seen": "2026-11-12 16:44", "source": "ThreatFox" }, { "ioc": "217.60.21.214:56002", "type": "ip:port", "threat": "botnet_cc", "malware": "PureRAT", "confidence": 75, "first_seen": "2026-11-12 16:44", "source": "ThreatFox" }, { "ioc": "20.193.133.171:7443", "type": "ip:port", "threat": "botnet_cc", "malware": "Unknown malware", "confidence": 75, "first_seen": "2026-11-12 16:44", "source": "ThreatFox" }, { "ioc": "185.254.198.112:8443", "type": "ip:port", "threat": "botnet_cc", "malware": "Evilginx", "confidence": 75, "first_seen": "2026-11-12 16:43", "source": "ThreatFox" }, { "ioc": "184.75.208.50:40471", "type": "ip:port", "threat": "botnet_cc", "malware": "AsyncRAT", "confidence": 75, "first_seen": "2026-11-12 16:43", "source": "ThreatFox" }, { "ioc": "184.75.208.50:27382", "type": "ip:port", "threat": "botnet_cc", "malware": "AsyncRAT", "confidence": 75, "first_seen": "2026-11-12 16:43", "source": "ThreatFox" }, { "ioc": "163.245.222.159:8443", "type": "ip:port", "threat": "botnet_cc", "malware": "Evilginx", "confidence": 75, "first_seen": "2026-11-12 16:43", "source": "ThreatFox" }, { "ioc": "16.164.215.235:7001", "type": "ip:port", "threat": "botnet_cc", "malware": "DeimosC2", "confidence": 75, "first_seen": "2026-11-12 16:43", "source": "ThreatFox" }, { "ioc": "157.20.182.100:56001", "type": "ip:port", "threat": "botnet_cc", "malware": "PureRAT", "confidence": 75, "first_seen": "2026-11-12 16:43", "source": "ThreatFox" }, { "ioc": "138.68.153.131:8443", "type": "ip:port", "threat": "botnet_cc", "malware": "Evilginx", "confidence": 75, "first_seen": "2026-11-12 16:43", "source": "ThreatFox" }, { "ioc": "128.90.102.75:7777", "type": "ip:port", "threat": "botnet_cc", "malware": "DCRat", "confidence": 75, "first_seen": "2026-11-12 16:43", "source": "ThreatFox" }, { "ioc": "ee3pb36f.galsab.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-12 16:37", "source": "ThreatFox" }, { "ioc": "143.244.143.24:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-12 16:36", "source": "ThreatFox" }, { "ioc": "galsab.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-12 16:34", "source": "ThreatFox" }, { "ioc": "72.5.42.221:443", "type": "ip:port", "threat": "botnet_cc", "malware": "Jackskid", "confidence": 100, "first_seen": "2026-11-12 16:30", "source": "ThreatFox" }, { "ioc": "ak-demia.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:17", "source": "ThreatFox" }, { "ioc": "acevesfarms.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:17", "source": "ThreatFox" }, { "ioc": "t3dfleet.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:17", "source": "ThreatFox" }, { "ioc": "baburbaksho.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:17", "source": "ThreatFox" }, { "ioc": "astral-travel.biz", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:17", "source": "ThreatFox" }, { "ioc": "3years-10million.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:17", "source": "ThreatFox" }, { "ioc": "https://nexguard.pro/ae8ouxb9gx/7b3f6658ca0efb5d", "type": "url", "threat": "payload_delivery", "malware": "Unknown malware", "confidence": 90, "first_seen": "2026-11-12 16:12", "source": "ThreatFox" }, { "ioc": "86a.mom", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:07", "source": "ThreatFox" }, { "ioc": "adalartasimacilik.cyou", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:07", "source": "ThreatFox" }, { "ioc": "abba-swede-dreamz.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:07", "source": "ThreatFox" }, { "ioc": "aboncleaningservices.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:07", "source": "ThreatFox" }, { "ioc": "33l.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:07", "source": "ThreatFox" }, { "ioc": "armenmartirosyan.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:07", "source": "ThreatFox" }, { "ioc": "alloffplan.ae", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:07", "source": "ThreatFox" }, { "ioc": "adiposopathy.org", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:07", "source": "ThreatFox" }, { "ioc": "anymadental.es", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 16:07", "source": "ThreatFox" }, { "ioc": "c9.anka4d.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-12 16:05", "source": "ThreatFox" }, { "ioc": "ci.ankasanet.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-12 16:05", "source": "ThreatFox" }, { "ioc": "83.172.159.224:8987", "type": "ip:port", "threat": "botnet_cc", "malware": "VShell", "confidence": 100, "first_seen": "2026-11-12 16:05", "source": "ThreatFox" }, { "ioc": "185.7.214.167:9909", "type": "ip:port", "threat": "botnet_cc", "malware": "Quasar RAT", "confidence": 100, "first_seen": "2026-11-12 16:05", "source": "ThreatFox" }, { "ioc": "1a7d4b5bc83af4c3535a8e1cd97a032547eb9e7653a6551e828bab14655a6b33", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 15:58", "source": "ThreatFox" }, { "ioc": "1d2c04c5757040ec0f68dccd59beadd5e93d8811087422b4fc22d69ebc821c34", "type": "sha256_hash", "threat": "payload", "malware": "Mirai", "confidence": 90, "first_seen": "2026-11-12 15:58", "source": "ThreatFox" }, { "ioc": "ahmetlievdenevenakliye.cyou", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 15:57", "source": "ThreatFox" }, { "ioc": "alfajarind.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 15:57", "source": "ThreatFox" }, { "ioc": "www.atakentlastik.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 15:57", "source": "ThreatFox" }, { "ioc": "www.aractrafik.com.tr", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 15:57", "source": "ThreatFox" }, { "ioc": "avcilartasimacilik.cyou", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 15:57", "source": "ThreatFox" }, { "ioc": "85.122.114.16:8080", "type": "ip:port", "threat": "botnet_cc", "malware": "Aisuru", "confidence": 100, "first_seen": "2026-11-12 15:45", "source": "ThreatFox" }, { "ioc": "http://153.117.9.211:38263/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-12 15:20", "source": "ThreatFox" }, { "ioc": "http://115.58.97.226:42688/Mozi.m", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-12 15:20", "source": "ThreatFox" }, { "ioc": "http://223.123.47.15:59145/Mozi.a", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-12 15:20", "source": "ThreatFox" }, { "ioc": "http://223.123.34.111:59658/Mozi.a", "type": "url", "threat": "payload_delivery", "malware": "Mozi", "confidence": 75, "first_seen": "2026-11-12 15:20", "source": "ThreatFox" }, { "ioc": "lp.patriciaelias.com.br", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 15:17", "source": "ThreatFox" }, { "ioc": "ystglobalmanagement.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "whithaven.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "whiskerwalkz.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "virexontech.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "truselfcounselingservices.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "tarmaweb.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "sandyheatingandair.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "tajdarmedicalservices.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "singpa.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "sgm-holdings.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "serenehomeliving.net", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "princetonmtg.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "primverlag.at", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "piramida.club", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "patrickhufschmidt.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "oroojloo.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "nexusflownetwork.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "micolomero.it", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "mendrake.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "marcalexanderprosthodontics.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "lovelivingholdings.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "listverkfabrikken.no", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "jerryelectricllc.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "federicolosito.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "coopercapitalholdings.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "dkjglobal.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "doxologylabs.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "gurudaspurbarta.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "floorblock.co", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "ironlionservices.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "heallivingsolutions.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "davidthompsoncoaching.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "elitepuppypets.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "brookheavyhaulingllc.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "cirrus-living.de", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "cleavesecurity.com", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "arsproanima.pl", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "apr-hamburg.de", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 100, "first_seen": "2026-11-12 15:10", "source": "ThreatFox" }, { "ioc": "jd.ankasanet.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-12 15:05", "source": "ThreatFox" }, { "ioc": "chomleaestates.co.uk", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-12 14:52", "source": "ThreatFox" }, { "ioc": "colegiojeanpiaget.com.br", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-12 14:52", "source": "ThreatFox" }, { "ioc": "brunofoglia.it", "type": "domain", "threat": "payload_delivery", "malware": "IClickFix", "confidence": 75, "first_seen": "2026-11-12 14:51", "source": "ThreatFox" }, { "ioc": "4gpkk0qy.devam.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-12 14:09", "source": "ThreatFox" }, { "ioc": "queue8.forestbrief.website", "type": "domain", "threat": "botnet_cc", "malware": "RevStealer", "confidence": 75, "first_seen": "2026-11-12 14:08", "source": "ThreatFox" }, { "ioc": "hy.ankasanet.org", "type": "domain", "threat": "botnet_cc", "malware": "Vidar", "confidence": 100, "first_seen": "2026-11-12 14:05", "source": "ThreatFox" }, { "ioc": "www.xtracarehospital.com", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 90, "first_seen": "2026-11-12 14:02", "source": "ThreatFox" }, { "ioc": "devam.store", "type": "domain", "threat": "payload_delivery", "malware": "ClearFake", "confidence": 100, "first_seen": "2026-11-12 13:57", "source": "ThreatFox" } ] }