S0453 - Pony

Pony is a credential stealing malware, though has also been used among adversaries for its downloader capabilities. The source code for Pony Loader 1.0 and 2.0 were leaked online, leading to their use by various threat actors.

Author
agomez
Created
2023-03-27 15:59:15
Last updated
2026-02-07 18:39:24
Downloads
432255
IPv4 indicators
9
Hostname indicators
110
URL indicators
16
Sample indicators
918

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

jvl-jp.co Hostname

modified 2026-11-06 12:39:40
Gen:Variant.Strictor (Hybrid-Analysis) · Pony (Cybercrime-tracker.net) · Lokibot (Cybercrime-tracker.net)

gamestoredownload.download Hostname

modified 2026-11-06 12:39:26
maldoc (Maltiverse) · exploit (Maltiverse) · evasive,pony,trojan (Maltiverse) · Pony (Cybercrime-tracker.net) · Malware distribution site (VxVault)

thepstore.online Hostname

modified 2026-11-06 12:39:17
Pony (Cybercrime-tracker.net)

kocdestek.redirectme.net Hostname

modified 2026-11-06 12:39:09
Pony (Cybercrime-tracker.net) · Malicious domain (SANS Internet Storm Center) · Citadel (Cybercrime-tracker.net)

roliex.com Hostname

modified 2026-11-06 12:38:56
Pony (Cybercrime-tracker.net)

ecocalor.ro Hostname

modified 2026-11-06 12:38:45
Botnet (Mr.Looquer) · Pony (Cybercrime-tracker.net)

cp.saol.com Hostname

modified 2026-11-06 12:38:29
Pony (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis)

wireshark-download.sytes.net Hostname

modified 2026-11-06 12:38:25
Pony (Cybercrime-tracker.net)

cyclonemousery.com.au Hostname

modified 2026-11-06 12:37:50
Pony (Cybercrime-tracker.net)

supremegenerator.com Hostname

modified 2026-11-06 12:37:38
Pony (Cybercrime-tracker.net)

top.enkey.xyz Hostname

modified 2026-11-06 12:36:36
Pony (ThreatFox Abuse.ch)

cs-game.bl.ee Hostname

modified 2026-11-06 12:36:30
Pony (Cybercrime-tracker.net)

lavorwash.mx Hostname

modified 2026-11-06 12:36:22
Malicious domain (SANS Internet Storm Center) · Pony (Cybercrime-tracker.net)

westkinon.gq Hostname

modified 2026-11-06 09:30:54
Pony (Cybercrime-tracker.net)

kjt.hu Hostname

modified 2026-11-06 08:42:24
Pony (ThreatFox Abuse.ch)

photocoffee.com.au Hostname

modified 2026-11-06 08:42:19
Phishing (Phishtank) · Malicious domain (SANS Internet Storm Center) · Pony (Cybercrime-tracker.net)

kbfvzoboss.bid Hostname

modified 2026-11-06 08:40:03
Pony (Cybercrime-tracker.net) · Malicious domain (SANS Internet Storm Center) · Malicious site (Hybrid-Analysis) · Covid19 scam (Cyber Threat Coalition) · Malicious Hostname (Cyber Threat Coalition)

ironcompany.com.ve Hostname

modified 2026-11-06 08:39:24
Pony (Cybercrime-tracker.net)

ojme.net Hostname

modified 2026-11-06 08:39:09
Pony (Cybercrime-tracker.net) · Malicious site (Hybrid-Analysis)

vipfilenet.uni.me Hostname

modified 2026-11-06 08:39:05
Carbon (Cybercrime-tracker.net) · Solar (Cybercrime-tracker.net) · Pony (Cybercrime-tracker.net)

mypony.nl Hostname

modified 2026-11-06 08:38:50
Social Engineering (Google Safebrowsing) · Pony (Cybercrime-tracker.net) · Loki Password Stealer (PWS) (ThreatFox Abuse.ch)

http://onlygoodman.com/yedi/admin.php URL

modified 2026-11-06 06:34:40
Pony (Cybercrime-tracker.net)

mpsound.eu Hostname

modified 2026-11-06 04:41:25
Pony (Cybercrime-tracker.net) · Pony (ThreatFox Abuse.ch)

www.pflanzen123.4kp.de Hostname

modified 2026-11-06 04:40:33
Pony (Cybercrime-tracker.net)

tankionlinecheats.zzz.com.ua Hostname

modified 2026-11-06 04:39:48
Pony (Cybercrime-tracker.net) · Malicious domain (SANS Internet Storm Center) · Proxy (IPWhois.io)

collectcoins.net Hostname

modified 2026-11-06 04:39:21
Pony (Cybercrime-tracker.net)

russiancat1337.zzz.com.ua Hostname

modified 2026-11-06 04:39:20
Pony (Cybercrime-tracker.net) · Proxy (IPWhois.io)

worldbiggestsocialnetwork.in Hostname

modified 2026-11-06 04:38:52
Pony (Cybercrime-tracker.net)

07aa8fed2cb2273f03632f80eda628514f9fa41744019cb1e9d78f06db897e01 Sample

modified 2026-11-06 02:11:32
Fareit (Cyber Threat Alliance)

7541be23747d86f34238a6c3701c12cb37fd83df067ce9214a81eb321de7073f Sample

modified 2026-11-06 02:09:39
Fareit (Cyber Threat Alliance)

hivamusic.ir Hostname

modified 2026-11-06 01:47:58
Alexa Top 1 Million (Alexa) · Malicious URL (Hybrid-Analysis) · Pony (ThreatFox Abuse.ch) · Pony (Maltiverse Threat Observatory)

6f023913f3a8c14cbe3953e65b130f4c3776c5e5cdd0c6dd1653fd669f9c394a Sample

modified 2026-11-06 01:28:33
Fareit (Cyber Threat Alliance)

a0faa779c818a1305eed1853e5dd479c6295f15d25076e4fa9438f8faa66b8b8 Sample

modified 2026-11-06 01:12:39
Fareit (Cyber Threat Alliance)

cmp.com.sg Hostname

modified 2026-11-06 00:39:01
TROJ_FRS.0NP105JM18 (Hybrid-Analysis) · Malicious domain (SANS Internet Storm Center) · Alexa Top 1 Million (Alexa) · Pony (ThreatFox Abuse.ch)

smithman.in Hostname

modified 2026-11-06 00:38:19
Stealer (Cybercrime-tracker.net) · Pony (Cybercrime-tracker.net) · ZeuS (Cybercrime-tracker.net) · Malicious domain (SANS Internet Storm Center)

bonneli.rs Hostname

modified 2026-11-06 00:36:38
Pony (ThreatFox Abuse.ch)

maqfax.com.br Hostname

modified 2026-11-06 00:35:59
Pony (Cybercrime-tracker.net)

4bcb55d09c485db98dcd96ebdc74b20ea73761e0e1d076c58a16ef29986c3da3 Sample

modified 2026-11-06 00:04:36
Fareit (Cyber Threat Alliance)

af3fbf76bbe84f8a02442117d1b40f500f927b63b22759f013563b8c9aef29f5 Sample

modified 2026-11-05 23:43:40
Fareit (Cyber Threat Alliance)

d7a626f085eeeb7364b7b430a7c34a5ae8b3a094abd88061b3bacccf0180025c Sample

modified 2026-11-05 23:20:37
Fareit (Cyber Threat Alliance)

bab6ece862f9a70d2d36809093c39236eb3a76fea1104fb775a91aa6f503bbf2 Sample

modified 2026-11-05 23:13:34
Fareit (Cyber Threat Alliance)

aefa8ccb889513ba76211128ce262ac202b1634b0d1393d0164e9081961b2397 Sample

modified 2026-11-05 23:01:37
Fareit (Cyber Threat Alliance)

9507cee1c6b8bb6bef0a889569e61db2c97da123f3d1a5a7a8a3f11ce8f82958 Sample

modified 2026-11-05 22:57:33
Fareit (Cyber Threat Alliance)

48fc6e6b7048b3a8ec30eb2afa2e2781eb5ed2f213fb4eeb8cbe30b99b7e3712 Sample

modified 2026-11-05 22:15:37
Fareit (Cyber Threat Alliance)

wisepay.com.ng Hostname

modified 2026-11-05 20:40:29
Pony (Cybercrime-tracker.net)

tilepikinonies.gr Hostname

modified 2026-11-05 20:39:04
Pony (Cybercrime-tracker.net)

paraiso.co.in Hostname

modified 2026-11-05 20:37:24
Pony (Cybercrime-tracker.net)

ks-marine.com Hostname

modified 2026-11-05 20:36:48
Pony (Cybercrime-tracker.net)

casasarticola.house Hostname

modified 2026-11-05 20:36:02
Malware Download (URLhaus Abuse.ch) · Pony (ThreatFox Abuse.ch)

forexdispatch.info Hostname

modified 2026-11-05 20:35:47
Gen:Variant.Razy (Hybrid-Analysis) · Gen:Variant.Midie (Hybrid-Analysis) · Generic.Malware (Hybrid-Analysis) · Lokibot (Cybercrime-tracker.net) · Pony (Cybercrime-tracker.net)

americar.rs Hostname

modified 2026-11-05 20:35:34
Pony (ThreatFox Abuse.ch) · Pony (Cybercrime-tracker.net)

www.queenshippartners.com Hostname

modified 2026-11-05 20:35:16
Pony (Cybercrime-tracker.net)

65b6b16d15b91eb578b384377eb89cafd99c7671976f244cf3310cb7b368e7cd Sample

modified 2026-11-05 19:27:31
Fareit (Cyber Threat Alliance)

https://papersacksfactory.ae/images/bulk_images/files/4447738147.pdf URL

modified 2026-11-05 18:32:58
Pony (Maltiverse Threat Observatory)

bbef56b7e98d0e4273eee5bd1a4417b991982cebe18fcf5ad0f9f33521291e13 Sample

modified 2026-11-05 18:31:37
Fareit (Cyber Threat Alliance)

7e7d86b54c4e02d7d8519d7e3bc396d74e65a61b4481fbbfbf009e2f3d331a4d Sample

modified 2026-11-05 18:29:39
Fareit (Cyber Threat Alliance)

7455f2f3ae78f8fb10f8c2818a95e2f6299024b64391bfd4ca1f7097790b4eac Sample

modified 2026-11-05 18:21:42
Fareit (Cyber Threat Alliance)

5.206.225.104 IPv4

modified 2026-11-05 18:14:55
Malware Download (Abuse.ch) · Malicious host (Talos Intelligence) · ISB.Downloader (Hybrid-Analysis) · CVE-2014-6352 (Hybrid-Analysis) · malicious.moderate.ml (Hybrid-Analysis)

51c15c70a6392d68479549d6a78cc6d541c830374684b5620c0c96075919076b Sample

modified 2026-11-05 17:59:32
Fareit (Cyber Threat Alliance)

392908e86a27a7b253bd220e10cc1716735793dacc5240b63f487ec2fdbfd37d Sample

modified 2026-11-05 17:31:31
Fareit (Cyber Threat Alliance)

rnarport.com Hostname

modified 2026-11-05 16:41:18
Malware site (Hybrid-Analysis) · DangerousObject.Multi (Hybrid-Analysis) · Gen:Variant.Graftor (Hybrid-Analysis) · Fareit.JO.gen (Hybrid-Analysis) · Backdoor.Fareit (Hybrid-Analysis)

kendra.fr Hostname

modified 2026-11-05 16:41:04
ZeuS (Cybercrime-tracker.net) · Pony (Cybercrime-tracker.net) · Gorynych (Cybercrime-tracker.net) · Citadel (Cybercrime-tracker.net)

nbatours.in Hostname

modified 2026-11-05 16:40:56
Pony (Cybercrime-tracker.net)

cush007.ddns.net Hostname

modified 2026-11-05 16:40:53
Nanocore RAT (ThreatFox Abuse.ch) · Gen:Variant.Graftor (Hybrid-Analysis) · BehavesLike.Fareit (Hybrid-Analysis) · Injector.EGKJ (Hybrid-Analysis) · Generic.Malware (Hybrid-Analysis)

killz.pro Hostname

modified 2026-11-05 16:39:34
Pony (Cybercrime-tracker.net) · Lokibot (Cybercrime-tracker.net)

rudyv.nl Hostname

modified 2026-11-05 16:39:06
Pony (Cybercrime-tracker.net)

stpowered.com.sg Hostname

modified 2026-11-05 16:39:05
Pony (Cybercrime-tracker.net) · Trojan.Generic (Hybrid-Analysis)

global-trans.co.id Hostname

modified 2026-11-05 16:38:45
Pony (Cybercrime-tracker.net)

esoviajar.com.br Hostname

modified 2026-11-05 16:38:31
Pony (Cybercrime-tracker.net)

tasdanlar.com.tr Hostname

modified 2026-11-05 16:37:56
Malicious domain (SANS Internet Storm Center) · Pony (Cybercrime-tracker.net)

holysmoke.com.cy Hostname

modified 2026-11-05 16:37:56
Malicious domain (SANS Internet Storm Center) · Pony (Cybercrime-tracker.net)

onlygoodman.com Hostname

modified 2026-11-05 16:37:14
Backdoor.Androm (Hybrid-Analysis) · W32.eHeur (Hybrid-Analysis) · CVE-2017-11882 (Hybrid-Analysis) · Lokibot (Cybercrime-tracker.net) · Malware Download (Abuse.ch)

upclosetours.co.za Hostname

modified 2026-11-05 16:37:05
Pony (Maltiverse Threat Observatory)

abcmedicalcenter.ro Hostname

modified 2026-11-05 16:36:46
Pony (ThreatFox Abuse.ch)

nile.com.jo Hostname

modified 2026-11-05 16:36:05
QakBot (ThreatFox Abuse.ch) · Alexa Top 1 Million (Alexa) · Pony (Cybercrime-tracker.net)

sariincofood.co.id Hostname

modified 2026-11-05 16:36:05
Pony (Cybercrime-tracker.net) · TOP AMENAZAS - 19022020 (CronUp Threat Intel) · Threats200220200050 (CronUp Threat Intel) · Lokibot (Cybercrime-tracker.net)

helpyourneighbors.org Hostname

modified 2026-11-05 16:36:04
Pony (Cybercrime-tracker.net)

iadvancetech.com Hostname

modified 2026-11-05 16:32:48
Fareit (Cyber Threat Alliance)

adwokaci-zielonagora.pl Hostname

modified 2026-11-05 16:32:48
Fareit (Cyber Threat Alliance)

ovalpix.co.uk Hostname

modified 2026-11-05 16:32:48
Fareit (Cyber Threat Alliance) · Compromised verdict (Maltiverse)

b657ab0b1b231da40e9111169700db5bff2d0bea86fcae9f6f88d6f6b11a4929 Sample

modified 2026-11-05 16:23:00
Fareit (Cyber Threat Alliance)

b65d0b9f75f66a2309e23cf04be58f9ea6f1c85fcf796461160032887b6aa58e Sample

modified 2026-11-05 16:22:38
Fareit (Cyber Threat Alliance)

131.72.236.158 IPv4

modified 2026-11-05 16:18:39
Phishing Generic/Spear Phishing (OpenPhish) · Phishing Navy Fedeal Credit Union (OpenPhish) · Phishing Yahoo! Inc (OpenPhish) · Phishing Dropbox (OpenPhish) · Phishing BT Group plc (OpenPhish)

c90f18ea4073174cb2d6cb922a942b2dfe2998e4374711ae159f0a92ee4bb266 Sample

modified 2026-11-05 16:06:46
Fareit (Cyber Threat Alliance)

53876eda9049aef75dead2c6ec123919cdbfbf0f285a94e28c8caa447973421c Sample

modified 2026-11-05 16:04:38
Fareit (Cyber Threat Alliance)

12bd99618398b770106d8f0ecdbaa217cf9ba03c83bd24dbff4e7515f9d74ee6 Sample

modified 2026-11-05 15:36:38
Fareit (Cyber Threat Alliance)

45736e52d8f76a479b246fc60703939845004347a684eb21833950806cb569bf Sample

modified 2026-11-05 14:39:31
Fareit (Cyber Threat Alliance)

a949cda0b07f1573259919b960f7b8fc3533531f24246f3c0710bf6e09e21e31 Sample

modified 2026-11-05 14:23:37
Fareit (Cyber Threat Alliance)

e355e5698580914e007aa0eb5fde77fa37987cfed69a3eddbf91d16490f6b81f Sample

modified 2026-11-05 14:07:39
Fareit (Cyber Threat Alliance)

9bd0ffb3a81c3eae8fd910e41b81bfffbd0fda55cc6205f70443100f0c9e409b Sample

modified 2026-11-05 14:03:31
Fareit (Cyber Threat Alliance)

35a9b18702e390f33bd57e734ab46bd41c3b2f319cf78889b942eba326e269d0 Sample

modified 2026-11-05 13:56:36
Fareit (Cyber Threat Alliance)

4946b2ae1f0421ef033ba2418740d7b30e559a0b6697e52380bab709a6cdde6c Sample

modified 2026-11-05 13:52:33
Fareit (Cyber Threat Alliance)

f201cb3f3224136432470599c7ac5c1dcb08b80004953111f6ab6d7de2efd327 Sample

modified 2026-11-05 13:50:37
Fareit (Cyber Threat Alliance)

stritaschools.com Hostname

modified 2026-11-05 12:38:48
Pony (Cybercrime-tracker.net)

370fa1747b875992897406be9be3b6fbbbd78ac1c3a8863cf1b7995b70f1878a Sample

modified 2026-11-05 12:37:40
Fareit (Cyber Threat Alliance)

choppbratz.com.br Hostname

modified 2026-11-05 12:37:30
Pony (Cybercrime-tracker.net) · Malicious domain (SANS Internet Storm Center) · Botnet (Mr.Looquer)

onelove03.duckdns.org Hostname

modified 2026-11-05 12:37:21
NetWire RC (ThreatFox Abuse.ch) · BehavesLike.Fareit (Hybrid-Analysis) · DangerousObject.Multi (Hybrid-Analysis) · TOP AMENAZAS - 19022020 (CronUp Threat Intel) · Threats200220200050 (CronUp Threat Intel)

vsama.com Hostname

modified 2026-11-05 12:35:26
Botnet (Mr.Looquer) · Web (Mr.Looquer) · Pony (Cybercrime-tracker.net)

agulino.com Hostname

modified 2026-11-05 12:35:12
pony (Maltiverse) · Pony (Cybercrime-tracker.net)

bongaust.bl.ee Hostname

modified 2026-11-05 12:33:39
Pony (Cybercrime-tracker.net)