Cybercrime

Covers most active and prolific threats used by active organized cybercrime. It contemplates IoCs from diverse malware families in its different stages.

Author
agomez
Created
2020-04-19 12:16:21
Last updated
2026-02-09 20:14:58
Downloads
6656333
IPv4 indicators
3385
Hostname indicators
15892
URL indicators
17562
Sample indicators
46319

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

https://img2.huorongsec.com/zh3G URL

modified 2026-10-18 07:34:42
Cobalt strike (Maltiverse Threat Observatory)

tfwed.duckdns.org Hostname

modified 2026-10-18 07:34:40
AsyncRAT (ThreatFox Abuse.ch) · Asyncrat (Maltrail)

latinbrands.pe Hostname

modified 2026-10-18 07:27:18
QakBot (ThreatFox Abuse.ch) · Malware Download (URLhaus Abuse.ch)

ascoitaliasa.duckdns.org Hostname

modified 2026-10-18 07:26:20
Remcos (ThreatFox Abuse.ch)

http://www.childlesscatlady.today/2kmz/ URL

modified 2026-10-18 07:22:29
Formbook (ThreatFox Abuse.ch)

safer.ddns.net Hostname

modified 2026-10-18 07:21:24
Remcos (ThreatFox Abuse.ch) · AIT:Trojan.GenericTKA (Hybrid-Analysis) · Gen:Variant.Razy (Hybrid-Analysis)

coreagency.net Hostname

modified 2026-10-18 07:18:33
Formbook (Maltrail)

kkk123.no-ip.biz Hostname

modified 2026-10-18 07:18:01
NjRAT (ThreatFox Abuse.ch)

https://bbs.microsoftsync.net/YSGi URL

modified 2026-10-18 07:15:59
Cobalt strike (Maltiverse Threat Observatory)

http://img2.huorongsec.com/3Axp URL

modified 2026-10-18 07:13:33
Cobalt strike (Maltiverse Threat Observatory)

http://www.hacdop.com/le/config.php?account=legal URL

modified 2026-10-18 07:12:46
FormBook (Cybercrime-tracker.net)

sempersim.su Hostname

modified 2026-10-18 07:06:54
Nanocore RAT (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis) · LokiBot (ThreatFox Abuse.ch) · Loki Password Stealer (PWS) (ThreatFox Abuse.ch) · Malicious.behaviour (Maltiverse Threat Observatory)

recieviblrggg.duckdns.org Hostname

modified 2026-10-18 07:05:46
Ave Maria (ThreatFox Abuse.ch)

harveyautos112.ddns.net Hostname

modified 2026-10-18 06:57:47
Remcos (ThreatFox Abuse.ch)

SKMBTTRC0CN0111019BK46K.js Sample

modified 2026-10-18 06:46:55
Agent Tesla (Triage) · AgentTesla (MalwareBazaar Abuse.ch)

tehran.ddns.net Hostname

modified 2026-10-18 06:44:04
NjRAT (ThreatFox Abuse.ch)

iniiivan.ydns.eu Hostname

modified 2026-10-18 06:43:30
Remcos (ThreatFox Abuse.ch)

https://bbs.microsoftsync.net/5Gsm URL

modified 2026-10-18 06:42:59
Cobalt strike (Maltiverse Threat Observatory)

zzujllop.cannca.shop Hostname

modified 2026-10-18 06:36:17
Joker (Maltrail)

thewhitespace.qa Hostname

modified 2026-10-18 06:35:21
Malware Download (URLhaus Abuse.ch) · DarkGate (ThreatFox Abuse.ch)

zadno.run Hostname

modified 2026-10-18 06:35:18
Smokeloader (Maltiverse Threat Observatory) · Remus (ThreatFox Abuse.ch)

agronewbk.duckdns.org Hostname

modified 2026-10-18 06:32:53
Remcos (ThreatFox Abuse.ch)

silly-swirles.207-246-119-197.plesk.page Hostname

modified 2026-10-18 06:32:34
ShadowPad (ThreatFox Abuse.ch)

8.tcp.us-cal-1.ngrok.io Hostname

modified 2026-10-18 06:32:16
RedLine Stealer (ThreatFox Abuse.ch)

brucebaner2031.duckdns.org Hostname

modified 2026-10-18 06:31:18
Remcos (ThreatFox Abuse.ch) · Remcos (Maltiverse Threat Observatory)

attiferstudio.com Hostname

modified 2026-10-18 06:31:04
Apt37 (Maltiverse)

tcwine.us Hostname

modified 2026-10-18 06:30:58
Quasar RAT (ThreatFox Abuse.ch)

red67cf1511d7c6ea1d5b1ac316679cd4a.ws Hostname

modified 2026-10-18 06:28:24
dyre (Maltiverse Research Team)

185.140.53.9 IPv4

modified 2026-10-18 06:27:47
Remcos (ThreatFox Abuse.ch) · Nanocore RAT (ThreatFox Abuse.ch) · AGEN.1131750 (Hybrid-Analysis) · MSIL_Kryptik.AWS.gen (Hybrid-Analysis) · GenKryptik.EMOR (Hybrid-Analysis)

84.217.24.176 IPv4

modified 2026-10-18 06:22:59
Ransom.WannaCrypt (Hybrid-Analysis) · Mail Spammer (Barracuda)

175.107.1.216 IPv4

modified 2026-10-18 06:19:49
Kimsuky (Maltiverse) · Malware Download (URLhaus Abuse.ch) · (URLhaus Abuse.ch) · Mail Spammer (Abuseat.org) · Malicious Host (HoneyDB)

thedoccloud.com Hostname

modified 2026-10-18 06:18:29
SolarWinds C2 (Maltiverse Research Team) · Malicious site (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella) · Sunburst (Maltiverse Threat Observatory)

databasegalore.com Hostname

modified 2026-10-18 06:18:29
SolarWinds C2 (Maltiverse Research Team) · Malware site (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella) · Sunburst (Maltiverse Threat Observatory)

deftsecurity.com Hostname

modified 2026-10-18 06:18:27
Malware site (Hybrid-Analysis) · SolarWinds C2 (Maltiverse Research Team) · Top Popularity Site (Cisco Umbrella) · Sunburst (Maltiverse Threat Observatory)

freescanonline.com Hostname

modified 2026-10-18 06:18:20
Malicious site (Hybrid-Analysis) · SolarWinds C2 (Maltiverse Research Team) · Top Popularity Site (Cisco Umbrella) · Sunburst (Maltiverse Threat Observatory)

url.emailprotection.link Hostname

modified 2026-10-18 06:17:51
Phishing site (Hybrid-Analysis) · Phishing PayPal (Phishtank) · Apple ID phishing (Antiphishing.com.ar) · Malware Download (Abuse.ch) · Emotet (Abuse.ch)

go.ly Hostname

modified 2026-10-18 06:17:23
Phishing (Antiphishing.com.ar) · Phishing JPMorgan Chase and Co. (Phishtank) · Top 1M Site (Cisco Umbrella) · Phishing Apple (Phishtank) · Phishing domain (Maltiverse Threat Observatory)

91.92.243.15 IPv4

modified 2026-10-18 06:17:07
Mail Spammer (Abuseat.org) · SIP Attacker (Blocklist.de) · Malicious Host (CIArmy) · ET CINS Active Threat Intelligence Poor Reputation IP TCP (Emerging Threats) · ET CINS Active Threat Intelligence Poor Reputation IP UDP (Emerging Threats)

e6ac25f9a9cb0129b3ca2ca7975d92be465ceb493b0aafeda13b318d63a21ebe Sample

modified 2026-10-18 06:16:07
NetWire (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

6621d19a2d174e41aeb8090d7b3641fcdfb65c30d17eae73fca062e3b972aacf Sample

modified 2026-10-18 06:15:52
PoisonIvy (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

6a7a4bcf1a16e15695b6b64fd62a163410a1eafa185a0eeeafd7039b8c85605a Sample

modified 2026-10-18 06:12:22
Ursnif (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

146.70.98.98 IPv4

modified 2026-10-18 06:11:56
Proxy (IPWhois.io) · VPN proton (Maltiverse Threat Observatory) · Proton (Maltiverse Threat Observatory) · VPN (IPWhois.io) · Generic Malware (Maltiverse Threat Observatory)

0f33cbccbf7a2bd7d6376e6c25c9c334242f448753f4c1010f4dbbd66f0dd3f7 Sample

modified 2026-10-18 06:11:17
Sliver (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

1875f1f0aa59cdd1d273c8b7a9c97790b753bb3bfdfc912dd5a816d54348f14e Sample

modified 2026-10-18 06:09:47
Emotet (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

46ea4229f1c588a2ab620beb908ac1efe14f1a369bdc5a8056c0e783e25941e6 Sample

modified 2026-10-18 06:07:18
njRAT (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

f573029d7eb46347bcb2a7734f718bdd959a49d47468214c4d5f331b31e050da Sample

modified 2026-10-18 06:06:07
Cobaltstrike (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

9c0c407ab87b09bf28475fe1053173f7709a6c3640d6bfd246b17d2107fcafb9 Sample

modified 2026-10-18 06:06:05
Mimikatz (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

304fcfbf513be129159e9dee829aa8c1e92c3bbae2584c082fa0a3502763b674 Sample

modified 2026-10-18 06:05:55
Remcos (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

6255a592d679e5da2eb2eeb2c23e0dc220a232f5369ba4376bdfd7adc457a934 Sample

modified 2026-10-18 06:05:52
Cosmicduke (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

721b456e41a756d2370bae9da9ca5bd345ef8f732f7a5707c2114a88940d3685 Sample

modified 2026-10-18 06:05:19
CobaltStrike (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

d323d737c4470359f2f78d77a804a9f2ad68cc61756c7eac92b712484445d98f Sample

modified 2026-10-18 06:05:17
NetWire (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

https://apn-state-upd2.com/p5Pss34GvX21pxO0bz25vLqU.php URL

modified 2026-10-18 06:03:06
StrongPity (ThreatFox Abuse.ch)

2026-07-02_b77f77ef26aef1db33ce4bf0da2bbafb_glassworm_lazagne_njrat Sample

modified 2026-10-18 06:01:37
Lazagne (Triage)

https://static.s123-cdn-static-b.com/uploads/4650279/normal_61ab38a515a1e.pdf URL

modified 2026-10-18 06:01:33
Deathransom (Maltiverse Threat Observatory)

138.199.6.178 IPv4

modified 2026-10-18 05:54:53
Proxy (IPWhois.io) · Proton (Maltiverse Threat Observatory) · VPN (IPWhois.io) · Generic Malware (Maltiverse Threat Observatory) · VPN ProtonVPN (Maltiverse Threat Observatory)

ttriber.com Hostname

modified 2026-10-18 05:54:45
Generic Malware (Maltiverse Threat Observatory) · Deathransom (Maltiverse Threat Observatory) · Sharpknot (Maltiverse Threat Observatory) · Artemis.ransomware (Maltiverse Threat Observatory) · Backdoor.win32.generic (Maltiverse Threat Observatory)

187.24.70.150 IPv4

modified 2026-10-18 05:53:50
Mail Spammer (Abuseat.org) · AsyncRAT (ThreatFox Abuse.ch) · Asyncrat (Maltrail) · Mail Spammer (Barracuda)

http://static.s123-cdn-static.com/uploads/4368770/normal_5fddd6e71da2c.pdf URL

modified 2026-10-18 05:53:30
Qakbot (Maltiverse Threat Observatory)

883c2a0baad376ee656a375120c6e7e294d24184e19f54f0020c054b20f6d8e3 Sample

modified 2026-10-18 05:53:06
Asyncrat (Triage)

https://static.s123-cdn-static.com/uploads/4368770/normal_5fddd6e71da2c.pdf URL

modified 2026-10-18 05:52:15
Qakbot (Maltiverse Threat Observatory)

0e21f85809123aacf5fb0cf20e628cb02b14d2536298237f98a501d5fd16b373.dll Sample

modified 2026-10-18 05:51:23
Generic.Malware (MalwareBazaar Abuse.ch) · Stuxnet (Triage)

static.s123-cdn-static.com Hostname

modified 2026-10-18 05:51:05
Phishing site (Hybrid-Analysis) · Malicious site (Hybrid-Analysis) · Generic.Malware (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella) · Malware Download (URLhaus Abuse.ch)

titine555.ddns.net Hostname

modified 2026-10-18 05:50:02
Quasar RAT (ThreatFox Abuse.ch)

kasongogold.com Hostname

modified 2026-10-18 05:49:45
Lokibot (Cybercrime-tracker.net) · CVE-2017-11882 (Hybrid-Analysis) · malicious.d205d1 (Hybrid-Analysis) · Loki Password Stealer (PWS) (ThreatFox Abuse.ch)

divmainbot.pages.dev Hostname

modified 2026-10-18 05:49:18
Malware Download (URLhaus Abuse.ch) · Agent Tesla (Maltrail)

2026-10-18_f6ad97fe92ab9386c74cf798cedfc065_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 05:49:00
Netwire (Triage)

socolive.tube_ransome.exe Sample

modified 2026-10-18 05:48:19
Nanocore (Triage)

metin2coder.duckdns.org Hostname

modified 2026-10-18 05:48:06
Nanocore RAT (ThreatFox Abuse.ch)

socolive.tube_new.exe Sample

modified 2026-10-18 05:47:21
Nanocore (Triage)

2026-10-18_f700b4d9f930a215f70db83cac47e8b0_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 05:47:13
Netwire (Triage)

fiadusus.com Hostname

modified 2026-10-18 05:47:02
Astaroth (Maltiverse Threat Observatory)

socolive.tube_nano.exe Sample

modified 2026-10-18 05:46:44
Nanocore (Triage)

daisy101.ddns.net Hostname

modified 2026-10-18 05:45:46
Nanocore RAT (ThreatFox Abuse.ch) · Trojan.Generic (Hybrid-Analysis)

socolive.tube_chrome.exe Sample

modified 2026-10-18 05:45:31
Nanocore (Triage)

svvhost.exe Sample

modified 2026-10-18 05:45:04
DarkTortilla (MalwareBazaar Abuse.ch) · DarkTortilla (ThreatFox Abuse.ch) · Generic Malware (Hybrid-Analysis)

HEHE.exe Sample

modified 2026-10-18 05:45:04
Remcos (Triage) · Generic Malware (Hybrid-Analysis)

sample-4d19c517cf60.exe Sample

modified 2026-10-18 05:45:04
Nanocore (Triage) · Generic Malware (Hybrid-Analysis)

sample-47398fc0d93a.exe Sample

modified 2026-10-18 05:45:04
Nanocore (Triage) · Generic Malware (Hybrid-Analysis)

4db89c39db14f4d9f76d06c50fef2d9282e83c03e8c948a863b58dedc43edd31 Sample

modified 2026-10-18 05:44:52
Fin8 (Maltiverse) · Fin7 (Maltiverse)

f02eca433cdb78186c1614b914ff4aa8da47dd430e8288ad721bd1da610f32d5 Sample

modified 2026-10-18 05:44:21
Generic.Malware (Abuse.ch) · FlawedAmmyy (Abuse.ch)

supply-dressing.gl.at.ply.gg Hostname

modified 2026-10-18 05:44:07
Quasar RAT (ThreatFox Abuse.ch)

nhin cai lon ma may 9999.exe Sample

modified 2026-10-18 05:42:14
Remcos (Triage)

ultahost.gl Hostname

modified 2026-10-18 05:41:27
CountLoader (ThreatFox Abuse.ch) · Lumma stealer (Maltiverse Threat Observatory) · Trojan.js.generic (Maltiverse Threat Observatory) · acrstealer (Maltiverse Threat Observatory)

nhin cai lon ma may 999.exe Sample

modified 2026-10-18 05:40:57
Remcos (Triage)

2.88.155.150 IPv4

modified 2026-10-18 05:40:08
Mail Spammer (Barracuda) · QakBot (ThreatFox Abuse.ch)

2026-10-18_f979ead0c0d685dda5f2804b3be8caed_elex_icedid_njrat_stealc Sample

modified 2026-10-18 05:39:39
Njrat (Triage)

2026-10-18_f97e398fb541c65cc9f96e94fd47de51_elex_emotet_remcos_wannacry Sample

modified 2026-10-18 05:39:00
Gh0strat (Triage)

24906793171.zip Sample

modified 2026-10-18 05:37:57
Play (Triage)

2026-10-18_f9dfedc7e349eb770fa0f98a647f8652_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 05:36:54
Netwire (Triage)

fpfid.football_ransome.exe Sample

modified 2026-10-18 05:36:54
Nanocore (Triage)

fpfid.football_new.exe Sample

modified 2026-10-18 05:36:28
Nanocore (Triage)

recoverlostpassword.com Hostname

modified 2026-10-18 05:36:12
Program.Unwanted (Hybrid-Analysis) · Generic.Malware (Hybrid-Analysis) · Wacatac (Hybrid-Analysis) · Trojan.GenAsa (Hybrid-Analysis) · Malware (Hybrid-Analysis)

lionskins.co.exe Sample

modified 2026-10-18 05:35:34
Asyncrat (Triage)

http://img2.huorongsec.com/jiGB URL

modified 2026-10-18 05:33:17
Cobalt strike (Maltiverse Threat Observatory)

ftp.melrz.com Hostname

modified 2026-10-18 05:30:50
Agent Tesla (ThreatFox Abuse.ch)

rSolicita____odePropostas_pdf.exe Sample

modified 2026-10-18 05:28:26
Generic Malware (Hybrid-Analysis) · Agent Tesla (Triage) · AgentTesla (MalwareBazaar Abuse.ch)

lazagne.exe Sample

modified 2026-10-18 05:26:59
Generic Malware (Hybrid-Analysis) · Application.Lazagne (Hybrid-Analysis)

2026-10-18_fd58fd3c99e74e51fa92481ea336a2e6_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 05:26:06
Netwire (Triage)

2026-06-12_e714e8a3e42c2d15b732691f56be16a3_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader Sample

modified 2026-10-18 05:23:20
Netwire (Triage)

r2.e-z.host Hostname

modified 2026-10-18 05:22:00
Top Popularity Site (Cisco Umbrella) · Malware Download (URLhaus Abuse.ch) · Deathransom (Maltiverse Threat Observatory) · Hacktool.generic (Maltiverse Threat Observatory) · Trojan.generic (Maltiverse Threat Observatory)