Advanced Persistent Threats

Maltiverse APT threat intelligence feed provides IoCs related to highly skilled, sophisticated and focused Attack Groups currenty active. That includes Nation-State Sponsored APTs, Corporate-Sponsored APTs, Cybercriminal Groups, Hacktivist Groups and Terrorist Groups

Author
agomez
Created
2023-01-21 18:52:34
Last updated
2024-04-09 16:41:29
Downloads
8839671
IPv4 indicators
82
Hostname indicators
1586
URL indicators
117
Sample indicators
1825

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

mdsonline.co.in Hostname

modified 2026-11-06 17:45:47
Apt37 (Maltiverse) · QakBot (ThreatFox Abuse.ch) · Alexa Top 1 Million (Alexa) · Malware Download (URLhaus Abuse.ch)

5.181.2.72 IPv4

modified 2026-11-06 17:15:52
Anonymizer (Maltiverse) · Anonymizer (Maltiverse Research Team) · Anonymizer (FireHol) · Proxy (FireHOL) · Anonymizer (FireHOL)

theotech.com.py Hostname

modified 2026-11-06 17:05:28
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

2.59.163.4 IPv4

modified 2026-11-06 17:05:06
Proxy (IPWhois.io) · Anonymizer (FireHOL) · Proxy (FireHOL) · Potassium (ThreatFox Abuse.ch)

2026-03-13_0cb4c08c70d54ef2967f7a0b62a0b11a_amadey_elex_play Sample

modified 2026-11-06 16:59:52
Play (Triage)

exchange.openmd5.com Hostname

modified 2026-11-06 16:39:12
Malicious URL (Hybrid-Analysis) · Redgolf (Maltiverse) · Aurora Panda (Maltiverse) · Axiom (Maltiverse)

agostodc20.duckdns.org Hostname

modified 2026-11-06 16:39:11
Dcrat (Maltiverse Threat Observatory) · AsyncRAT (ThreatFox Abuse.ch) · APT-C-36 (Maltiverse) · Asyncrat (Maltiverse Threat Observatory) · Generic Malware (Maltiverse Threat Observatory)

www.ndoc-post.cloud-ip.cc Hostname

modified 2026-11-06 16:39:10
Kimsuky (ThreatFox Abuse.ch)

lovely4u.nl Hostname

modified 2026-11-06 16:39:10
Kimsuky (ThreatFox Abuse.ch)

update.ms-office.app Hostname

modified 2026-11-06 16:38:49
SideWinder (ThreatFox Abuse.ch)

tech-assist.com.au Hostname

modified 2026-11-06 16:38:27
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

mailsco-govpk.myvnc.com Hostname

modified 2026-11-06 16:38:17
SideWinder (ThreatFox Abuse.ch)

hrmis-financegovpk.serveftp.com Hostname

modified 2026-11-06 16:38:02
SideWinder (ThreatFox Abuse.ch)

webdisk.us Hostname

modified 2026-11-06 16:38:02
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

mail-updateservice.info Hostname

modified 2026-11-06 16:37:47
Malicious URL (Hybrid-Analysis) · OilRig (Maltiverse)

fritoburgers.com Hostname

modified 2026-11-06 16:37:47
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

test.support Hostname

modified 2026-11-06 16:37:30
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

tprlink.com Hostname

modified 2026-11-06 16:37:27
Transparent Tribe (Maltrail)

evolutionshotcrete.com.au Hostname

modified 2026-11-06 16:37:12
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

buymesub.com Hostname

modified 2026-11-06 16:37:04
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

regjoubertattorneys.co.za Hostname

modified 2026-11-06 16:36:46
Muddywater (Maltiverse) · QakBot (ThreatFox Abuse.ch)

nid-session.govt.hu Hostname

modified 2026-11-06 16:36:35
naver phishing (Maltiverse) · Kimsuky (ThreatFox Abuse.ch)

login.transamerica-hr.com Hostname

modified 2026-11-06 16:36:19
0Ktapus (Maltrail)

eskco-op.com.au Hostname

modified 2026-11-06 16:36:12
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch) · Malware Download (URLhaus Abuse.ch)

ticket.ipv10.eu Hostname

modified 2026-11-06 16:35:58
Apt37 (Maltiverse)

kavachmail-govin.rf.gd Hostname

modified 2026-11-06 16:35:38
Transparent Tribe (Maltrail)

eservice-ptclnetpk.servehttp.com Hostname

modified 2026-11-06 16:35:29
SideWinder (ThreatFox Abuse.ch)

3030pp.hopto.org Hostname

modified 2026-11-06 16:35:28
TA558 (Maltiverse)

dialog.gg Hostname

modified 2026-11-06 16:35:27
Apt37 (Maltiverse)

email-govin.duia.eu Hostname

modified 2026-11-06 16:35:13
Trojan.Generic (Hybrid-Analysis) · Malicious site (Hybrid-Analysis) · Malicious URL (Hybrid-Analysis) · Transparent Tribe (Maltrail)

awards-piacaero.servehttp.com Hostname

modified 2026-11-06 16:35:09
SideWinder (ThreatFox Abuse.ch)

mail-nespak-com-pk.gwadarportt.workers.dev Hostname

modified 2026-11-06 16:34:53
SideWinder (ThreatFox Abuse.ch)

support-ntc.servehttp.com Hostname

modified 2026-11-06 16:34:42
SideWinder (ThreatFox Abuse.ch)

careerpredictto.space Hostname

modified 2026-11-06 16:34:11
Lazarus (Maltiverse Threat Observatory)

growlb.com Hostname

modified 2026-11-06 16:33:44
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

mail-mofapk.servehttp.com Hostname

modified 2026-11-06 16:33:28
SideWinder (ThreatFox Abuse.ch)

msn-service.co Hostname

modified 2026-11-06 16:33:17
OilRig (Maltiverse)

codipsa.com.py Hostname

modified 2026-11-06 16:33:13
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

er-edoc.ezgateway.net Hostname

modified 2026-11-06 16:33:11
naver phishing (Maltiverse) · Kimsuky (ThreatFox Abuse.ch)

srdm.in Hostname

modified 2026-11-06 16:33:07
Apt37 (Maltiverse) · QakBot (ThreatFox Abuse.ch) · VB:Trojan.Valyria (Hybrid-Analysis) · Malware (Hybrid-Analysis) · Malware Download (Abuse.ch)

www.boja.us Hostname

modified 2026-11-06 16:33:07
Apt37 (Maltiverse)

grab-indonesia.com Hostname

modified 2026-11-06 16:33:07
Apt37 (Maltiverse)

fortigate.forticloud.online Hostname

modified 2026-11-06 16:33:07
0Ktapus (Maltrail)

icacitperu.org Hostname

modified 2026-11-06 16:33:07
2023-05-30 16:50:48 (URLhaus Abuse.ch) · Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

indomobilhino.co.id Hostname

modified 2026-11-06 16:32:53
Apt37 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

zacharryblogs.com Hostname

modified 2026-11-06 16:32:34
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella)

secure-cps.nl Hostname

modified 2026-11-06 16:32:31
Kimsuky (ThreatFox Abuse.ch)

mld.navers.mew-pol.dns.navy Hostname

modified 2026-11-06 16:32:30
Kimsuky (ThreatFox Abuse.ch)

ns-3.open.ro Hostname

modified 2026-11-06 16:32:25
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

mail-pc-gov-pk-login.ethanhunthero125.workers.dev Hostname

modified 2026-11-06 16:13:20
SideWinder (ThreatFox Abuse.ch)

jiqaz.com Hostname

modified 2026-11-06 16:11:04
Sidewinder (Maltiverse) · Gamaredon Group (Maltiverse) · Razor Tiger (Maltiverse) · Malware Download (URLhaus Abuse.ch) · TeamBot (ThreatFox Abuse.ch)

msedgepackageinfo.com Hostname

modified 2026-11-06 16:09:05
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

085046ececcff959420164dc9ff1f78b7d05abf01d4fe00e35933cf98a0698e5.exe Sample

modified 2026-11-06 15:31:33
Spyware (VM-Ray) · Keylogger (VM-Ray) · Snake (ThreatFox Abuse.ch)

getsolara.dev Hostname

modified 2026-11-06 14:53:03
Malware Download (URLhaus Abuse.ch) · Top Popularity Site (Cisco Umbrella) · Malicious URL (Triage) · Chimera (Triage) · Generic Malware (Maltiverse Threat Observatory)

https://plushyplayground.org/ URL

modified 2026-11-06 14:34:15
Chimera (Triage) · Generic Malware (Maltiverse Threat Observatory)

https://srv-cdn3-system.com/p5Pss34GvX21pxO0bz25vLqU.php URL

modified 2026-11-06 14:32:09
StrongPity (ThreatFox Abuse.ch)

megadexcargo.com.my Hostname

modified 2026-11-06 12:41:29
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

astrazencea.com Hostname

modified 2026-11-06 12:40:40
OilRig (Maltiverse)

camaralastro.pb.gov.br Hostname

modified 2026-11-06 12:40:06
Apt37 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

offer-ptclnetpk.servehttp.com Hostname

modified 2026-11-06 12:39:43
SideWinder (ThreatFox Abuse.ch)

grupoallo.com.br Hostname

modified 2026-11-06 12:39:41
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

zaheeruddinconsultants.org Hostname

modified 2026-11-06 12:39:38
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

safe.bbits.solutions Hostname

modified 2026-11-06 12:39:38
Muddywater (Maltiverse) · QakBot (ThreatFox Abuse.ch)

mail-mod-gov-pk.pakistan-gov-pk.workers.dev Hostname

modified 2026-11-06 12:39:25
SideWinder (ThreatFox Abuse.ch)

www.dservices.space Hostname

modified 2026-11-06 12:39:25
Bahamut (ThreatFox Abuse.ch)

swi.org.lb Hostname

modified 2026-11-06 12:39:24
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

mail.news Hostname

modified 2026-11-06 12:39:24
Nitro (Maltiverse) · Darkhotel (Maltiverse) · Ice Fog (Maltiverse) · Projectsauron (Maltiverse) · Cobalt Strike (Maltiverse)

maill-support.com Hostname

modified 2026-11-06 12:39:23
OilRig (Maltiverse)

inini.kesug.com Hostname

modified 2026-11-06 12:39:15
Kimsuky (ThreatFox Abuse.ch) · Malware Download (URLhaus Abuse.ch)

vendemmiavintage.com.ar Hostname

modified 2026-11-06 12:39:14
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

mail.irir.org Hostname

modified 2026-11-06 12:38:55
Malicious URL (Hybrid-Analysis) · Backdoordiplomacy (Maltiverse) · Malicious behavior (Maltiverse Threat Observatory)

www.aieov.com Hostname

modified 2026-11-06 12:38:51
Malicious URL (Hybrid-Analysis) · Teamspy (Maltiverse Research Team) · Malware (Hybrid-Analysis) · Trojan.AgentWDCR (Hybrid-Analysis) · Gen:Variant.Barys (Hybrid-Analysis)

exchange.portomnail.com Hostname

modified 2026-11-06 12:38:28
Redgolf (Maltiverse) · Aurora Panda (Maltiverse) · Axiom (Maltiverse)

elccorp-net.ntc-telecomcorporation.workers.dev Hostname

modified 2026-11-06 12:38:27
SideWinder (ThreatFox Abuse.ch)

pausewatchings.com Hostname

modified 2026-11-06 12:38:16
ta569 (Maltiverse Threat Observatory)

visualstudiofactory.com Hostname

modified 2026-11-06 12:38:14
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella)

acenor.com.py Hostname

modified 2026-11-06 12:37:53
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

assignmentmentor.co.uk Hostname

modified 2026-11-06 12:37:39
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

mail-hit-gov-pk.ntc-telecomcorporation.workers.dev Hostname

modified 2026-11-06 12:37:38
SideWinder (ThreatFox Abuse.ch)

www.alarm-doc-review.site Hostname

modified 2026-11-06 12:37:38
Kimsuky (ThreatFox Abuse.ch)

cdtpitbull.hopto.org Hostname

modified 2026-11-06 12:37:36
AsyncRAT (ThreatFox Abuse.ch) · TA558 (Maltiverse) · Asyncrat (Maltiverse Threat Observatory)

mail-invest-gov-pk.gwadarportt.workers.dev Hostname

modified 2026-11-06 12:37:36
SideWinder (ThreatFox Abuse.ch)

firefoxsystem.sytes.net Hostname

modified 2026-11-06 12:37:32
TA558 (Maltiverse)

cyberchef.net Hostname

modified 2026-11-06 12:36:48
Apt37 (Maltiverse)

hicom.com.pk Hostname

modified 2026-11-06 12:36:40
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

27.102.138.163 IPv4

modified 2026-11-06 11:03:25
Suspicious Host (AbuseIPDB) · Port Scanner (AbuseIPDB) · Bruteforce (AbuseIPDB) · SSH Attacker (AbuseIPDB) · SSH Attacker (Blocklist.de)

ATTACH_83920174.lnk Sample

modified 2026-11-06 10:57:29
Kimsuky (MalwareBazaar Abuse.ch)

https://srv-cdn3-system.com/goN9Z2In7mYQmN92dzX11CQL.php URL

modified 2026-11-06 10:30:26
StrongPity (ThreatFox Abuse.ch)

hik.gettingheadfromduckysmom.st Hostname

modified 2026-11-06 10:29:14
Potassium (ThreatFox Abuse.ch) · Generic Malware (Maltiverse Threat Observatory) · Mirai (Maltiverse Threat Observatory)

athene-usa.com Hostname

modified 2026-11-06 10:29:12
0Ktapus (Maltrail)

otp.er-edoc.ezgateway.net Hostname

modified 2026-11-06 09:59:05
Kimsuky (ThreatFox Abuse.ch)

www.paperless-korea.one Hostname

modified 2026-11-06 09:59:05
Kimsuky (ThreatFox Abuse.ch)

msstorageboxes.com Hostname

modified 2026-11-06 09:34:41
Lazarus Group (Maltiverse) · Unknown malware (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella)

microsoftcontents.com Hostname

modified 2026-11-06 08:54:38
Redgolf (Maltiverse) · Aurora Panda (Maltiverse) · Axiom (Maltiverse)

4success.zapto.org Hostname

modified 2026-11-06 08:42:26
TA558 (Maltiverse) · Trojan.MSIL (Hybrid-Analysis) · Covid19 scam (Cyber Threat Coalition) · Malicious Hostname (Cyber Threat Coalition) · Trojan.Autoit (Hybrid-Analysis)

ecospacer.com.au Hostname

modified 2026-11-06 08:42:00
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

slotgacorbola168.com Hostname

modified 2026-11-06 08:41:13
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

graphel.com.br Hostname

modified 2026-11-06 08:41:01
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

inversiones.com.pe Hostname

modified 2026-11-06 08:40:14
Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

whataburgermenus.com Hostname

modified 2026-11-06 08:40:13
2023-05-30 16:51:14 (URLhaus Abuse.ch) · Gold Cabin (Maltiverse) · Ta570 (Maltiverse) · QakBot (ThreatFox Abuse.ch)