S0453 - Pony

Pony is a credential stealing malware, though has also been used among adversaries for its downloader capabilities. The source code for Pony Loader 1.0 and 2.0 were leaked online, leading to their use by various threat actors.

Author
agomez
Created
2023-03-27 15:59:15
Last updated
2026-02-07 18:39:24
Downloads
412347
IPv4 indicators
12
Hostname indicators
134
URL indicators
16
Sample indicators
50

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

sariincofood.co.id Hostname

modified 2026-09-21 12:39:12
Pony (Cybercrime-tracker.net) · TOP AMENAZAS - 19022020 (CronUp Threat Intel) · Threats200220200050 (CronUp Threat Intel) · Lokibot (Cybercrime-tracker.net)

grupoalfra.cl Hostname

modified 2026-09-21 12:37:14
Pony (Cybercrime-tracker.net) · Pony (ThreatFox Abuse.ch)

gamestoredownload.download Hostname

modified 2026-09-21 12:37:09
maldoc (Maltiverse) · exploit (Maltiverse) · evasive,pony,trojan (Maltiverse) · Pony (Cybercrime-tracker.net) · Malware distribution site (VxVault)

roliex.com Hostname

modified 2026-09-21 12:36:47
Pony (Cybercrime-tracker.net)

gangonv1.beget.tech Hostname

modified 2026-09-21 12:36:03
Pony (Cybercrime-tracker.net)

mpsound.eu Hostname

modified 2026-09-21 12:35:48
Pony (Cybercrime-tracker.net) · Pony (ThreatFox Abuse.ch)

lavorwash.mx Hostname

modified 2026-09-21 12:35:48
Malicious domain (SANS Internet Storm Center) · Pony (Cybercrime-tracker.net)

kocdestek.redirectme.net Hostname

modified 2026-09-21 12:35:47
Pony (Cybercrime-tracker.net) · Malicious domain (SANS Internet Storm Center) · Citadel (Cybercrime-tracker.net)

tsiexpressinc.com Hostname

modified 2026-09-21 12:35:47
Pony (Cybercrime-tracker.net) · Malicious domain (SANS Internet Storm Center)

jvl-jp.co Hostname

modified 2026-09-21 12:35:40
Gen:Variant.Strictor (Hybrid-Analysis) · Pony (Cybercrime-tracker.net) · Lokibot (Cybercrime-tracker.net)

supremegenerator.com Hostname

modified 2026-09-21 12:35:21
Pony (Cybercrime-tracker.net)

www.fredlund.nu Hostname

modified 2026-09-21 12:34:15
KeyBase (Cybercrime-tracker.net) · Pony (Cybercrime-tracker.net)

tankionlinecheats.zzz.com.ua Hostname

modified 2026-09-21 12:34:11
Pony (Cybercrime-tracker.net) · Malicious domain (SANS Internet Storm Center) · Proxy (IPWhois.io)

rombul.com Hostname

modified 2026-09-21 12:33:44
Malicious domain (SANS Internet Storm Center) · Pony (Cybercrime-tracker.net)

sistemacplus.com.br Hostname

modified 2026-09-21 12:33:37
Social Engineering (Google Safebrowsing) · Pony (Cybercrime-tracker.net) · Malicious domain (SANS Internet Storm Center)

jaffacakes118__08725a797628bc037128ddcf0a0643de Sample

modified 2026-09-21 11:50:23
Pony (Triage)

diamant-paris.fr Hostname

modified 2026-09-21 08:51:10
Malware Download (Abuse.ch) · Pony (Mr.Looquer)

collectcoins.net Hostname

modified 2026-09-21 08:49:35
Pony (Cybercrime-tracker.net)

thepstore.online Hostname

modified 2026-09-21 08:47:59
Pony (Cybercrime-tracker.net)

c.lewd.se Hostname

modified 2026-09-21 08:47:23
autoit (Maltiverse) · pony (Maltiverse) · cerber,ransomware (Maltiverse) · pony,trojan (Maltiverse)

a0170719.xsph.ru Hostname

modified 2026-09-21 08:42:38
pony (Maltiverse)

cs-game.bl.ee Hostname

modified 2026-09-21 08:40:11
Pony (Cybercrime-tracker.net)

photocoffee.com.au Hostname

modified 2026-09-21 08:38:50
Phishing (Phishtank) · Malicious domain (SANS Internet Storm Center) · Pony (Cybercrime-tracker.net)

helpyourneighbors.org Hostname

modified 2026-09-21 08:37:53
Pony (Cybercrime-tracker.net)

russiancat1337.zzz.com.ua Hostname

modified 2026-09-21 08:37:10
Pony (Cybercrime-tracker.net) · Proxy (IPWhois.io)

worldbiggestsocialnetwork.in Hostname

modified 2026-09-21 08:37:02
Pony (Cybercrime-tracker.net)

forexdispatch.info Hostname

modified 2026-09-21 08:36:16
Gen:Variant.Razy (Hybrid-Analysis) · Gen:Variant.Midie (Hybrid-Analysis) · Generic.Malware (Hybrid-Analysis) · Lokibot (Cybercrime-tracker.net) · Pony (Cybercrime-tracker.net)

kvintexpo.ru Hostname

modified 2026-09-21 08:34:15
Malicious URL (Hybrid-Analysis) · pony (Maltiverse) · Pony (Cybercrime-tracker.net)

escort.in.ua Hostname

modified 2026-09-21 08:32:07
Pony (ThreatFox Abuse.ch) · Pony (Cybercrime-tracker.net) · Botnet (Mr.Looquer)

kingskillz.ru Hostname

modified 2026-09-21 08:12:23
ZeuS (Cybercrime-tracker.net) · Pony (Cybercrime-tracker.net) · Trojan.FareIt (malwaredomainlist.com) · Malicious domain (SANS Internet Storm Center)

jaffacakes118__0c6fe8509196a9811c11de6638e53254 Sample

modified 2026-09-21 07:56:35
Pony (Triage)

http://gamestoredownload.download/settings/animationsettings/admin.php URL

modified 2026-09-21 06:39:17
Pony (Cybercrime-tracker.net)

jaffacakes118__220d003d1496404717039d5f8d30cade Sample

modified 2026-09-21 05:05:37
Pony (Triage)

server3.streamservices.de Hostname

modified 2026-09-21 04:40:12
Pony (Cybercrime-tracker.net)

stritaschools.com Hostname

modified 2026-09-21 04:40:06
Pony (Cybercrime-tracker.net)

www.mideaz.com Hostname

modified 2026-09-21 04:39:55
Pony (Cybercrime-tracker.net)

veezer.club Hostname

modified 2026-09-21 04:39:27
Lokibot (Cybercrime-tracker.net) · exploit (Maltiverse) · banker ,lokibot (Maltiverse) · banker ,downloader ,fareit ,pony (Maltiverse) · banker ,downloader ,fareit ,pony ,trojan (Maltiverse)

markiz.lh1.in Hostname

modified 2026-09-21 04:39:13
Pony (Cybercrime-tracker.net)

www.global-sourcing.org Hostname

modified 2026-09-21 04:38:21
Botnet (Mr.Looquer) · Pony (Cybercrime-tracker.net)

cemeterystories.net Hostname

modified 2026-09-21 04:35:54
Malicious domain (SANS Internet Storm Center) · Pony (Cybercrime-tracker.net)

alyacht.com Hostname

modified 2026-09-21 04:35:52
Pony (Cybercrime-tracker.net) · Malicious domain (SANS Internet Storm Center)

aleksey3.bget.ru Hostname

modified 2026-09-21 04:35:37
Pony (Cybercrime-tracker.net)

global-trans.co.id Hostname

modified 2026-09-21 04:35:37
Pony (Cybercrime-tracker.net)

rudyv.nl Hostname

modified 2026-09-21 04:35:35
Pony (Cybercrime-tracker.net)

checkbs.com Hostname

modified 2026-09-21 04:35:34
Pony (Cybercrime-tracker.net) · Andromeda (Cybercrime-tracker.net)

salubritate-craiova.ro Hostname

modified 2026-09-21 04:35:20
Pony (Cybercrime-tracker.net) · Generic.Malware (Hybrid-Analysis) · Botnet (Mr.Looquer)

arthemo.com Hostname

modified 2026-09-21 04:34:23
banker,downloader,fareit,pony,trojan (Maltiverse) · Pony (Cybercrime-tracker.net) · Pony (ThreatFox Abuse.ch)

servioficina.es Hostname

modified 2026-09-21 00:39:41
Pony (Cybercrime-tracker.net)

aldierifs.com Hostname

modified 2026-09-21 00:39:22
Pony (Cybercrime-tracker.net) · Citadel (Cybercrime-tracker.net) · Pony (ThreatFox Abuse.ch)

www.precedeme.com Hostname

modified 2026-09-21 00:38:53
Pony (Cybercrime-tracker.net)

y4peace.org Hostname

modified 2026-09-21 00:37:37
Pony (Cybercrime-tracker.net) · banker,downloader,fareit,pony (Maltiverse) · exploit (Maltiverse) · rat ,trojan ,xrat ,xtrat ,xtreme (Maltiverse) · Generic.Malware (Hybrid-Analysis)

mudmagazine.co Hostname

modified 2026-09-21 00:36:57
Pony (ThreatFox Abuse.ch) · banker,downloader,evasive,fareit,pony,qrat,rat,trojan,zbot (Maltiverse)

mceneryfinancial.com Hostname

modified 2026-09-21 00:36:13
Pony (Cybercrime-tracker.net)

newstarmachinery.com Hostname

modified 2026-09-21 00:36:13
Malicious domain (SANS Internet Storm Center) · Pony (Cybercrime-tracker.net)

hope-care.co.uk Hostname

modified 2026-09-21 00:35:57
Botnet (Mr.Looquer) · Pony (Cybercrime-tracker.net)

cd84092.tmweb.ru Hostname

modified 2026-09-21 00:34:18
Pony (Cybercrime-tracker.net)

crudeoil.company Hostname

modified 2026-09-21 00:32:39
Neutrino (Cybercrime-tracker.net) · Pony (Cybercrime-tracker.net) · ZeuS (Cybercrime-tracker.net) · Malicious domain (SANS Internet Storm Center) · KeyBase (Cybercrime-tracker.net)

mypony.nl Hostname

modified 2026-09-21 00:32:20
Social Engineering (Google Safebrowsing) · Pony (Cybercrime-tracker.net) · Loki Password Stealer (PWS) (ThreatFox Abuse.ch)

bonneli.rs Hostname

modified 2026-09-21 00:32:16
Pony (ThreatFox Abuse.ch)

holysmoke.com.cy Hostname

modified 2026-09-21 00:31:31
Malicious domain (SANS Internet Storm Center) · Pony (Cybercrime-tracker.net)

pollymus.usa.cc Hostname

modified 2026-09-20 20:48:09
Pony (Cybercrime-tracker.net)

o-z-o.ru Hostname

modified 2026-09-20 20:38:39
Pony (Cybercrime-tracker.net)

ironcompany.com.ve Hostname

modified 2026-09-20 20:37:37
Pony (Cybercrime-tracker.net)

vipfilenet.uni.me Hostname

modified 2026-09-20 20:36:51
Carbon (Cybercrime-tracker.net) · Solar (Cybercrime-tracker.net) · Pony (Cybercrime-tracker.net)

maqfax.com.br Hostname

modified 2026-09-20 20:36:42
Pony (Cybercrime-tracker.net)

a0158290.xsph.ru Hostname

modified 2026-09-20 20:36:10
pony (Maltiverse)

www.mousawisa.com Hostname

modified 2026-09-20 20:35:26
ZeuS (Cybercrime-tracker.net) · Pony (Cybercrime-tracker.net)

alghaithtrd.ae Hostname

modified 2026-09-20 20:35:21
Botnet (Mr.Looquer) · Pony (Cybercrime-tracker.net)

abrami.in Hostname

modified 2026-09-20 20:34:46
Pony (Cybercrime-tracker.net)

theonlygoodman.com Hostname

modified 2026-09-20 20:33:54
Top Popularity Site (Cisco Umbrella) · Malicious site (Hybrid-Analysis) · Trojan.Agent (Hybrid-Analysis) · Trojan.Generic (Hybrid-Analysis) · Trojan.PWS (Hybrid-Analysis)

bongaust.bl.ee Hostname

modified 2026-09-20 20:33:49
Pony (Cybercrime-tracker.net)

stpowered.com.sg Hostname

modified 2026-09-20 20:33:22
Pony (Cybercrime-tracker.net) · Trojan.Generic (Hybrid-Analysis)

ultrafil.net Hostname

modified 2026-09-20 20:33:17
Pony (Cybercrime-tracker.net) · Malicious domain (SANS Internet Storm Center)

juliedclient.org.in Hostname

modified 2026-09-20 20:33:17
Malicious domain (SANS Internet Storm Center) · Pony (Cybercrime-tracker.net)

fourwaysgroup.com Hostname

modified 2026-09-20 20:33:01
Pony (ThreatFox Abuse.ch) · Malware site (Hybrid-Analysis) · Malicious site (Hybrid-Analysis) · Malicious domain (SANS Internet Storm Center) · Pony (Cybercrime-tracker.net)

ratpanel.sourceforge.net Hostname

modified 2026-09-20 20:32:53
Pony (Cybercrime-tracker.net) · Neutrino (Cybercrime-tracker.net)

50280.com Hostname

modified 2026-09-20 20:32:33
Pony (Cybercrime-tracker.net)

come2travel.com Hostname

modified 2026-09-20 20:32:07
Botnet (Mr.Looquer) · Malicious site (Hybrid-Analysis) · Pony (Cybercrime-tracker.net)

http://onlygoodman.com/yedi/admin.php URL

modified 2026-09-20 18:32:36
Pony (Cybercrime-tracker.net)

cyclonemousery.com.au Hostname

modified 2026-09-20 16:40:20
Pony (Cybercrime-tracker.net)

top.enkey.xyz Hostname

modified 2026-09-20 16:40:20
Pony (ThreatFox Abuse.ch)

americar.rs Hostname

modified 2026-09-20 16:40:15
Pony (ThreatFox Abuse.ch) · Pony (Cybercrime-tracker.net)

paraiso.co.in Hostname

modified 2026-09-20 16:40:13
Pony (Cybercrime-tracker.net)

www.wificam.it Hostname

modified 2026-09-20 16:40:00
pony (Maltiverse) · pony,trojan (Maltiverse)

smoothpanelz.allalla.com Hostname

modified 2026-09-20 16:39:30
Top Popularity Site (Cisco Umbrella) · Pony (Cybercrime-tracker.net)

coldheaded.us Hostname

modified 2026-09-20 16:39:02
pony (Maltiverse) · pony,trojan (Maltiverse) · Pony (Cybercrime-tracker.net)

smithman.in Hostname

modified 2026-09-20 16:38:17
Stealer (Cybercrime-tracker.net) · Pony (Cybercrime-tracker.net) · ZeuS (Cybercrime-tracker.net) · Malicious domain (SANS Internet Storm Center)

www.ttghk.com Hostname

modified 2026-09-20 16:38:15
Pony (Cybercrime-tracker.net)

wisepay.com.ng Hostname

modified 2026-09-20 16:36:56
Pony (Cybercrime-tracker.net)

rumenbg.com Hostname

modified 2026-09-20 16:36:38
Phishing (Phishtank) · Social Engineering (Google Safebrowsing) · Pony (Cybercrime-tracker.net)

sunmel.com Hostname

modified 2026-09-20 16:35:55
Pony (Cybercrime-tracker.net) · Malicious domain (SANS Internet Storm Center)

loverents.com Hostname

modified 2026-09-20 16:35:53
Pony (Cybercrime-tracker.net)

vsama.com Hostname

modified 2026-09-20 16:35:52
Botnet (Mr.Looquer) · Web (Mr.Looquer) · Pony (Cybercrime-tracker.net)

tilepikinonies.gr Hostname

modified 2026-09-20 16:35:51
Pony (Cybercrime-tracker.net)

nbatours.in Hostname

modified 2026-09-20 16:35:43
Pony (Cybercrime-tracker.net)

ijitm.com Hostname

modified 2026-09-20 16:35:41
Malicious domain (SANS Internet Storm Center) · Malware Download (Abuse.ch) · Pony (Cybercrime-tracker.net)

kendra.fr Hostname

modified 2026-09-20 16:35:34
ZeuS (Cybercrime-tracker.net) · Pony (Cybercrime-tracker.net) · Gorynych (Cybercrime-tracker.net) · Citadel (Cybercrime-tracker.net)

tasdanlar.com.tr Hostname

modified 2026-09-20 16:35:23
Malicious domain (SANS Internet Storm Center) · Pony (Cybercrime-tracker.net)

yoloswaginz.savethis.net Hostname

modified 2026-09-20 16:34:58
Pony (Cybercrime-tracker.net)

agulino.com Hostname

modified 2026-09-20 16:34:33
pony (Maltiverse) · Pony (Cybercrime-tracker.net)