Observatory

What the wider world is reporting — polled hourly, stored here, and always linked back to whoever said it.

updated just now

Feeds

110 indicators · 200 reportslast synced 17m ago

Everything CISA KEV Feodo Tracker HIBP NVD Leak sites ThreatFox URLhaus

CISA KEV: answered 17m ago; Vulnerabilities CISA has observed being exploited in the wild
Feodo Tracker: answered 17m ago; Botnet command-and-control servers abuse.ch observes answering right now — Emotet, QakBot, Dridex
HIBP: answered 17m ago; Data breaches disclosed and loaded into Have I Been Pwned
NVD: answered 17m ago; CVEs newly published to the National Vulnerability Database. A disclosure, not an exploit — most arrive before NVD has analysed them, and stay reported until it has
Leak sites: answered 17m ago; Victims a ransomware group has publicly claimed, tracked by ransomware.live. The claim is the attacker's — most victims never confirm it.
ThreatFox: answered 17m ago; Indicators abuse.ch ties to a named malware family
URLhaus: answered 17m ago; URLs submitted to abuse.ch as distributing malware

Today

110 entries

18m agocorroboratedwarningThreatFoxurl:hxxps://ez[.]ajuna88[.]org/zy/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
18m agocorroboratedwarningThreatFoxdomain:bossbeyavrupa[.]store
ClearFake indicator: domain
payload_delivery for ClearFake, reported by threatcat_ch at 100% confidence.
malware
ClearFake
tags
ClearFake
read the advisory ↗
22m agocorroboratedwarningThreatFoxsha256_hash:23746b451646aeaec0e56f813c7654fd75cb3c5a6d7c0e75fcda66c6287e5df2
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, Foxveil, macOS, nuyar
read the advisory ↗
23m agocorroboratedwarningThreatFoxurl:hxxps://ez[.]ajuna88[.]org/xi/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
26m agoreportedwarningURLhausurl:github[.]com
Malware distribution reported at github[.]com
malware_download reported by wristhulk; status online
url
online
tags
github, SalatStealer, zapret
reported 88× in the last 3hread the advisory ↗
all 88 reports
1. 2026-10-30 04:16onlinegithub, SalatStealer, zapret↗
2. 2026-10-30 04:16onlineexe, github, SalatStealer↗
3. 2026-10-30 04:16onlinegithub, SalatStealer, zapret↗
4. 2026-10-30 04:16onlineexe, github, SalatStealer↗
5. 2026-10-30 04:16onlinegithub, SalatStealer, zapret↗
6. 2026-10-30 04:16onlineexe, github, SalatStealer↗
7. 2026-10-30 04:16onlineexe, github, SalatStealer↗
8. 2026-10-30 04:16onlinegithub, SalatStealer, zapret↗
9. 2026-10-30 04:16onlineexe, github, SalatStealer↗
10. 2026-10-30 04:16onlineexe, github, SalatStealer↗
11. 2026-10-30 04:16onlineexe, github, SalatStealer↗
12. 2026-10-30 04:16onlinegithub, SalatStealer, zapret↗
13. 2026-10-30 04:16onlineexe, github, SalatStealer↗
14. 2026-10-30 04:16onlineexe, github, SalatStealer↗
15. 2026-10-30 04:16onlinegithub, SalatStealer, zapret↗
16. 2026-10-30 04:16onlineexe, github, SalatStealer↗
17. 2026-10-30 04:16onlineexe, github, SalatStealer↗
18. 2026-10-30 04:16onlineexe, github, SalatStealer↗
19. 2026-10-30 04:16onlineexe, github, SalatStealer↗
20. 2026-10-30 04:16onlineexe, github, SalatStealer↗
21. 2026-10-30 04:16onlineexe, github, SalatStealer↗
22. 2026-10-30 04:16onlinegithub, SalatStealer, zapret↗
23. 2026-10-30 04:16onlineexe, github, SalatStealer↗
24. 2026-10-30 04:16onlineexe, github, SalatStealer↗
25. 2026-10-30 04:16onlineexe, github, SalatStealer↗
26. 2026-10-30 03:20onlineexe, github, SalatStealer↗
27. 2026-10-30 03:20onlineexe, github, SalatStealer↗
28. 2026-10-30 03:20onlineexe, github, SalatStealer↗
29. 2026-10-30 03:20onlineexe, github, SalatStealer↗
30. 2026-10-30 03:20onlineexe, github, SalatStealer↗
31. 2026-10-30 03:20onlineexe, github, SalatStealer↗
32. 2026-10-30 03:20onlinegithub, SalatStealer, zapret↗
33. 2026-10-30 03:20onlineexe, github, SalatStealer↗
34. 2026-10-30 03:19onlineexe, github, SalatStealer↗
35. 2026-10-30 03:19onlineexe, github, SalatStealer↗
36. 2026-10-30 03:19onlineexe, github, SalatStealer↗
37. 2026-10-30 03:19onlineexe, github, SalatStealer↗
38. 2026-10-30 03:19onlineexe, github, SalatStealer↗
39. 2026-10-30 03:19onlinegithub, SalatStealer, zapret↗
40. 2026-10-30 03:19onlineexe, github, SalatStealer↗
41. 2026-10-30 03:19onlineexe, github, SalatStealer↗
42. 2026-10-30 03:19onlineexe, github, SalatStealer↗
43. 2026-10-30 03:19onlineexe, github, SalatStealer↗
44. 2026-10-30 03:19onlineexe, github, SalatStealer↗
45. 2026-10-30 03:19onlineexe, github, SalatStealer↗
46. 2026-10-30 03:19onlineexe, github, SalatStealer↗
47. 2026-10-30 03:19onlineexe, github, SalatStealer↗
48. 2026-10-30 03:19onlineexe, github, SalatStealer↗
49. 2026-10-30 03:19onlineexe, github, SalatStealer↗
50. 2026-10-30 03:19onlineexe, github, SalatStealer↗
51. 2026-10-30 02:21onlineexe, github, SalatStealer↗
52. 2026-10-30 02:21onlineexe, github, SalatStealer↗
53. 2026-10-30 02:21onlineexe, github, SalatStealer↗
54. 2026-10-30 02:21onlineexe, github, SalatStealer↗
55. 2026-10-30 02:20onlinegithub, SalatStealer, zapret↗
56. 2026-10-30 02:19onlineexe, github, SalatStealer↗
57. 2026-10-30 02:19onlineexe, github, SalatStealer↗
58. 2026-10-30 02:19onlineexe, github, SalatStealer↗
59. 2026-10-30 02:19onlineexe, github, SalatStealer↗
60. 2026-10-30 02:10onlinegithub, SalatStealer, zapret↗
61. 2026-10-30 02:10onlinegithub, SalatStealer, zapret↗
62. 2026-10-30 02:02onlinegithub, SalatStealer, zapret↗
63. 2026-10-30 02:02onlinegithub, SalatStealer, zapret↗
64. 2026-10-30 01:48onlinegithub, SalatStealer, zapret↗
65. 2026-10-30 01:19onlineexe, github, SalatStealer↗
66. 2026-10-30 01:18onlinegithub, SalatStealer, zapret↗
67. 2026-10-30 01:18onlinegithub, SalatStealer, zapret↗
68. 2026-10-30 01:18onlineexe, github, SalatStealer↗
69. 2026-10-30 01:18onlineexe, github, SalatStealer↗
70. 2026-10-30 01:18onlineexe, github, SalatStealer↗
71. 2026-10-30 01:18onlineexe, github, SalatStealer↗
72. 2026-10-30 01:18onlineexe, github, SalatStealer↗
73. 2026-10-30 01:18onlineexe, github, SalatStealer↗
74. 2026-10-30 01:18onlineexe, github, SalatStealer↗
75. 2026-10-30 01:18onlineexe, github, SalatStealer↗
76. 2026-10-30 01:18onlineexe, github, SalatStealer↗
77. 2026-10-30 01:18onlineexe, github, SalatStealer↗
78. 2026-10-30 01:18onlineexe, github, SalatStealer↗
79. 2026-10-30 01:18onlineexe, github, SalatStealer↗
80. 2026-10-30 01:18onlineexe, github, SalatStealer↗
81. 2026-10-30 01:18onlineexe, github, SalatStealer↗
82. 2026-10-30 01:18onlineexe, github, SalatStealer↗
83. 2026-10-30 01:18onlineexe, github, SalatStealer↗
84. 2026-10-30 01:18onlineexe, github, SalatStealer↗
85. 2026-10-30 01:18onlinegithub, SalatStealer, zapret↗
86. 2026-10-30 01:18onlineexe, github, SalatStealer↗
87. 2026-10-30 01:18onlinegithub, SalatStealer, zapret↗
88. 2026-10-30 01:18onlineexe, github, SalatStealer↗
27m agocorroboratedwarningThreatFoxsha256_hash:54c7ebe70c5981d14bda4f2ed99adbac28fcf390e4ddd0e0f272dd893f6caa1b
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, Foxveil, haven, macOS
read the advisory ↗
28m agocorroboratedwarningThreatFoxurl:hxxps://ez[.]ajuna88[.]org/roe/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
28m agoreportedinfoThreatFoxdomain:kodyxyju[.]workers[.]dev
php[.]shin_webshell indicator: domain
payload_delivery for php[.]shin_webshell, reported by xscon at 50% confidence.
malware
php[.]shin_webshell
tags
Cloudflare, gif, PHP, webshell, WordPress, workers[.]dev, wp-admin
read the advisory ↗
32m agocorroboratedwarningThreatFoxsha256_hash:85279394e95efea3d2678c9561021cb4a9f7a4d88dbafc74668ee918fff0fd0a
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, chant, ClickFix, Foxveil, macOS
read the advisory ↗
33m agocorroboratedwarningThreatFoxurl:hxxps://ez[.]ajuna88[.]org/f1/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
36m agocorroboratedwarningThreatFoxsha256_hash:69092c70e390ba31429d4bbd08ca01eef3415e665551d3d3a66b673f36ed48d3
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, Foxveil, macOS, willow
read the advisory ↗
38m agocorroboratedwarningThreatFoxurl:hxxps://ez[.]ajuna88[.]org/sa/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
38m agoreportedwarningThreatFoxip:port:154[.]91[.]54[.]173:9097
VShell indicator: ip:port
botnet_cc for VShell, reported by anonymous at 100% confidence.
malware
VShell
tags
Vshell
read the advisory ↗
38m agoreportedwarningThreatFoxip:port:154[.]91[.]54[.]169:9097
VShell indicator: ip:port
botnet_cc for VShell, reported by anonymous at 100% confidence.
malware
VShell
tags
Vshell
read the advisory ↗
38m agoreportedwarningThreatFoxip:port:154[.]91[.]54[.]165:9097
VShell indicator: ip:port
botnet_cc for VShell, reported by anonymous at 100% confidence.
malware
VShell
tags
Vshell
read the advisory ↗
38m agoreportedwarningThreatFoxip:port:154[.]91[.]54[.]163:9097
VShell indicator: ip:port
botnet_cc for VShell, reported by anonymous at 100% confidence.
malware
VShell
tags
Vshell
read the advisory ↗
38m agoreportedwarningThreatFoxip:port:154[.]91[.]53[.]182:9097
VShell indicator: ip:port
botnet_cc for VShell, reported by anonymous at 100% confidence.
malware
VShell
tags
Vshell
read the advisory ↗
42m agoreportedwarningThreatFoxurl:hxxps://xn--71-6kcajl7b5a2b[.]xn--p1ai/
Unknown malware indicator: url
payload_delivery for Unknown malware, reported by CarsonWilliams at 90% confidence.
malware
Unknown malware
tags
ClickFix
read the advisory ↗
43m agocorroboratedwarningThreatFoxurl:hxxps://jg[.]ajuna88[.]org/g3/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
43m agocorroboratedwarningThreatFoxurl:hxxps://s4[.]bb69[.]org/p/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
45m agocorroboratedwarningThreatFoxsha256_hash:be70832f18593e14e7e205abcb995ca2d030217a7cc6f6a37032b2c5d804aaea
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, Foxveil, macOS, quill
read the advisory ↗
47m agoreportedwarningThreatFoxsha256_hash:0fdd8680eee1762610d47515ace7b74b3ee715e93e5d1fbaecfa5b248fd1e187
Formbook indicator: sha256_hash
payload for Formbook, reported by Tuxxin at 90% confidence.
malware
Formbook
tags
Formbook, ps1
read the advisory ↗
47m agoreportedwarningThreatFoxsha256_hash:f51df4b117f65f70272204d7eb4f7b15caa495fd777ba7701884ad35ec2f07b3
Formbook indicator: sha256_hash
payload for Formbook, reported by Tuxxin at 90% confidence.
malware
Formbook
tags
Formbook, ps1
read the advisory ↗
47m agoreportedwarningThreatFoxsha256_hash:d75741349f4de1917c9d22ac48d95636290c04856c5facaccd6e2a128b47c6ee
Mirai indicator: sha256_hash
payload for Mirai, reported by Tuxxin at 90% confidence.
malware
Mirai
tags
Mirai, Sh
read the advisory ↗
47m agoreportedwarningThreatFoxsha256_hash:782cdb174d91a2c9116c077cdb4f23c3280c617ad352f169f97f221dd8a5fbd8
Overlord RAT indicator: sha256_hash
payload for Overlord RAT, reported by Tuxxin at 90% confidence.
malware
Overlord RAT
tags
exe, OverlordRAT
read the advisory ↗
47m agoreportedwarningThreatFoxsha256_hash:2c496e41d45ee787edef9c8dec4fe59e68a0d99746c899a6aabc6cbb36419bd6
Overlord RAT indicator: sha256_hash
payload for Overlord RAT, reported by Tuxxin at 90% confidence.
malware
Overlord RAT
tags
exe, OverlordRAT
read the advisory ↗
1h agocorroboratedwarningThreatFoxurl:hxxps://jg[.]ajuna88[.]org/ot/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
1h agocorroboratedwarningThreatFoxsha256_hash:3cf7e6fc1725c1bb709b1156bbaa1cf8fe4bab53f59609912984b70b7f140b2f
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, Foxveil, macOS, nuyar
read the advisory ↗
1h agocorroboratedwarningThreatFoxurl:hxxps://jg[.]ajuna88[.]org/g0/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
1h agoreportedwarningThreatFoxdomain:www[.]otticaimperatore[.]it
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 90% confidence.
malware
ClearFake
tags
compromised, etherhide
read the advisory ↗
1h agoreportedwarningThreatFoxdomain:www[.]pedipeus[.]com
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 90% confidence.
malware
ClearFake
tags
compromised, etherhide
read the advisory ↗
1h agoreportedwarningThreatFoxdomain:www[.]partyservice-regensburg[.]info
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 90% confidence.
malware
ClearFake
tags
compromised, etherhide
read the advisory ↗
1h agoreportedwarningThreatFoxdomain:www[.]panificiopallaria[.]it
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 90% confidence.
malware
ClearFake
tags
compromised, etherhide
read the advisory ↗
1h agocorroboratedwarningThreatFoxsha256_hash:7797272b8cff08547b5ec9fe085e7226bdbbb1845dcf06bbf9ca16526f3c6c50
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, Foxveil, haven, macOS
read the advisory ↗
1h agocorroboratedwarningThreatFoxurl:hxxps://jg[.]ajuna88[.]org/y3w/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
1h agocorroboratedwarningThreatFoxsha256_hash:68b1a3b00dcb3fd6601d30a3b7242d03e586d15d694abec2a6e426d38454ebeb
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, chant, ClickFix, Foxveil, macOS
read the advisory ↗
1h agocorroboratedwarningThreatFoxurl:hxxps://jg[.]ajuna88[.]org/x9/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
1h agoreportedwarningThreatFoxdomain:www[.]partitodemocraticobat[.]it
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 90% confidence.
malware
ClearFake
tags
compromised, etherhide
read the advisory ↗
1h agoreportedwarningThreatFoxdomain:orto-stazhkov[.]com[.]ua
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 90% confidence.
malware
ClearFake
tags
compromised, etherhide
read the advisory ↗
1h agocorroboratedwarningThreatFoxsha256_hash:3c0deee92fdc43f513533ea9703e14313e9a1b298563864133663eb18a12141f
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, Foxveil, macOS, willow
read the advisory ↗
1h agocorroboratedwarningThreatFoxurl:hxxps://lg[.]afktogel[.]org/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
1h agocorroboratedwarningThreatFoxurl:hxxps://jg[.]ajuna88[.]org/sro/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
1h agocorroboratedwarningThreatFoxdomain:lg[.]afktogel[.]org
Vidar indicator: domain
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
1h agoreportedwarningThreatFoxip:port:154[.]91[.]53[.]181:9097
VShell indicator: ip:port
botnet_cc for VShell, reported by anonymous at 100% confidence.
malware
VShell
tags
Vshell
read the advisory ↗
1h agoreportedwarningThreatFoxip:port:154[.]91[.]53[.]180:9097
VShell indicator: ip:port
botnet_cc for VShell, reported by anonymous at 100% confidence.
malware
VShell
tags
Vshell
read the advisory ↗
1h agoreportedwarningThreatFoxip:port:154[.]91[.]53[.]179:9097
VShell indicator: ip:port
botnet_cc for VShell, reported by anonymous at 100% confidence.
malware
VShell
tags
Vshell
read the advisory ↗
1h agoreportedwarningThreatFoxip:port:154[.]91[.]52[.]164:9097
VShell indicator: ip:port
botnet_cc for VShell, reported by anonymous at 100% confidence.
malware
VShell
tags
Vshell
read the advisory ↗
1h agoreportedwarningThreatFoxip:port:154[.]91[.]52[.]162:9097
VShell indicator: ip:port
botnet_cc for VShell, reported by anonymous at 100% confidence.
malware
VShell
tags
Vshell
read the advisory ↗
1h agocorroboratedwarningThreatFoxurl:hxxps://s4[.]bb69[.]org/r/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
1h agocorroboratedwarningThreatFoxurl:hxxps://k10[.]ajuna88[.]org/cl3/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
1h agocorroboratedwarningThreatFoxsha256_hash:14f4ff195c3d6719d0fe07d329e673dd99e7fc1354d05def2a95a7691997fc10
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, Foxveil, macOS, quill
read the advisory ↗
2h agocorroboratedwarningThreatFoxurl:hxxps://k10[.]ajuna88[.]org/ju/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
2h agocorroboratedwarningThreatFoxsha256_hash:b5568ab1d1f80c4332c4a0e053a5a245f7d65687df41cbd0111ecf13497a179f
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, Foxveil, macOS, stratos
read the advisory ↗
2h agocorroboratedwarningThreatFoxurl:hxxps://k10[.]ajuna88[.]org/p/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
2h agocorroboratedwarningThreatFoxdomain:facevaluenft[.]com
StrelaStealer indicator: domain
payload_delivery for StrelaStealer, reported by threatcat_ch at 100% confidence.
malware
StrelaStealer
tags
StrelaStealer
read the advisory ↗
2h agocorroboratedwarningThreatFoxsha256_hash:26395aca4be64added116b156c39db4dd98706e19f6651553b98e2326ed74085
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, Foxveil, frame, macOS
read the advisory ↗
2h agoreportedwarningURLhausurl:160[.]176[.]196[.]201
Malware distribution reported at 160[.]176[.]196[.]201
malware_download reported by adliwahid; status online
url
online
tags
Mozi
reported 2× in the last 3hread the advisory ↗
all 2 reports
1. 2026-10-30 02:17onlineMozi↗
2. 2026-10-30 01:47onlineMozi↗
2h agocorroboratedwarningThreatFoxurl:hxxps://k10[.]ajuna88[.]org/hh/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
2h agocorroboratedwarningThreatFoxsha256_hash:043dd3381cda35e5570b684d667e679660761049f37ea9a98c596d937a483c8f
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, Foxveil, macOS, nova
read the advisory ↗
2h agoreportedinfoThreatFoxdomain:169[.]174[.]116[.]136[.]bc[.]googleusercontent[.]com
php[.]shin_webshell indicator: domain
payload_delivery for php[.]shin_webshell, reported by xscon at 50% confidence.
malware
php[.]shin_webshell
tags
gif, PHP, webshell, WordPress, wp-admin
read the advisory ↗
2h agoreportedinfoThreatFoxdomain:37[.]250[.]142[.]34[.]bc[.]googleusercontent[.]com
php[.]shin_webshell indicator: domain
payload_delivery for php[.]shin_webshell, reported by xscon at 50% confidence.
malware
php[.]shin_webshell
tags
gif, PHP, webshell, WordPress, wp-admin
read the advisory ↗
2h agocorroboratedwarningThreatFoxurl:hxxps://k10[.]ajuna88[.]org/ty/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
2h agocorroboratedwarningThreatFoxsha256_hash:9460e64b27e828c6832f9ccb95d1caa5b6799c48648a362b6a2d5b0da6c5e311
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, Foxveil, macOS, nuyar
read the advisory ↗
2h agocorroboratedwarningThreatFoxurl:hxxps://s4[.]bb69[.]org/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
2h agocorroboratedwarningThreatFoxdomain:s4[.]bb69[.]org
Vidar indicator: domain
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
2h agocorroboratedwarningThreatFoxurl:hxxps://k10[.]ajuna88[.]org/aj/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
2h agoreportedwarningThreatFoxip:port:154[.]91[.]51[.]190:9097
VShell indicator: ip:port
botnet_cc for VShell, reported by anonymous at 100% confidence.
malware
VShell
tags
Vshell
read the advisory ↗
2h agoreportedwarningThreatFoxip:port:154[.]91[.]51[.]173:9097
VShell indicator: ip:port
botnet_cc for VShell, reported by anonymous at 100% confidence.
malware
VShell
tags
Vshell
read the advisory ↗
2h agoreportedwarningThreatFoxip:port:154[.]91[.]51[.]171:9097
VShell indicator: ip:port
botnet_cc for VShell, reported by anonymous at 100% confidence.
malware
VShell
tags
Vshell
read the advisory ↗
2h agoreportedwarningThreatFoxip:port:154[.]91[.]51[.]178:9097
VShell indicator: ip:port
botnet_cc for VShell, reported by anonymous at 100% confidence.
malware
VShell
tags
Vshell
read the advisory ↗
2h agoreportedwarningThreatFoxip:port:8[.]217[.]254[.]211:22
Unknown malware indicator: ip:port
botnet_cc for Unknown malware, reported by anonymous at 100% confidence.
malware
Unknown malware
tags
Supershell
read the advisory ↗
2h agoreportedwarningURLhausurl:125[.]46[.]131[.]53
Malware distribution reported at 125[.]46[.]131[.]53
malware_download reported by adliwahid; status online
url
online
read the advisory ↗
2h agoreportedwarningURLhausurl:182[.]116[.]38[.]41
Malware distribution reported at 182[.]116[.]38[.]41
malware_download reported by adliwahid; status online
url
online
tags
Mozi
read the advisory ↗
2h agoreportedwarningURLhausurl:raw[.]githubusercontent[.]com
Malware distribution reported at raw[.]githubusercontent[.]com
malware_download reported by wristhulk; status online
url
online
tags
github, SmartLoader, zip
reported 3× in the last 3hread the advisory ↗
all 3 reports
1. 2026-10-30 02:02onlinegithub, SmartLoader, zip↗
2. 2026-10-30 01:48onlinegithub, SmartLoader, zip↗
3. 2026-10-30 01:19onlinegithub, SmartLoader, zip↗
2h agocorroboratedwarningThreatFoxsha256_hash:32fb201d13db94bc21ea96d91fa50440d7b33abb6a7ccdc3277412d923d1b122
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, forge, Foxveil, macOS
read the advisory ↗
2h agoreportedwarningThreatFoxurl:hxxps://xn--frderverein-schule-gaustadt-pyc[.]de/
Unknown malware indicator: url
payload_delivery for Unknown malware, reported by CarsonWilliams at 90% confidence.
malware
Unknown malware
tags
ClickFix
read the advisory ↗
2h agoreportedwarningThreatFoxurl:hxxps://www[.]xn--90abz0a[.]xn--p1ai/
Unknown malware indicator: url
payload_delivery for Unknown malware, reported by CarsonWilliams at 90% confidence.
malware
Unknown malware
tags
ClickFix
read the advisory ↗
2h agoreportedwarningThreatFoxurl:hxxps://xn--chodnie-samochodowe-6fd[.]pl/
Unknown malware indicator: url
payload_delivery for Unknown malware, reported by CarsonWilliams at 90% confidence.
malware
Unknown malware
tags
ClickFix
read the advisory ↗
2h agoreportedwarningThreatFoxurl:hxxps://xn--logopdie-busse-9hb[.]de/
Unknown malware indicator: url
payload_delivery for Unknown malware, reported by CarsonWilliams at 90% confidence.
malware
Unknown malware
tags
ClickFix
read the advisory ↗
2h agoreportedwarningThreatFoxurl:hxxps://zaferron[.]com/
Unknown malware indicator: url
payload_delivery for Unknown malware, reported by CarsonWilliams at 90% confidence.
malware
Unknown malware
tags
ClickFix
read the advisory ↗
2h agoreportedwarningURLhausurl:123[.]14[.]35[.]54
Malware distribution reported at 123[.]14[.]35[.]54
malware_download reported by adliwahid; status online
url
online
tags
Mozi
read the advisory ↗
2h agoreportedwarningURLhausurl:221[.]15[.]186[.]102
Malware distribution reported at 221[.]15[.]186[.]102
malware_download reported by adliwahid; status online
url
online
read the advisory ↗
2h agoreportedwarningURLhausurl:120[.]28[.]212[.]172
Malware distribution reported at 120[.]28[.]212[.]172
malware_download reported by adliwahid; status online
url
online
tags
mirai
read the advisory ↗
2h agoreportedwarningURLhausurl:42[.]230[.]43[.]21
Malware distribution reported at 42[.]230[.]43[.]21
malware_download reported by adliwahid; status online
url
online
tags
Mozi
read the advisory ↗
2h agoreportedwarningURLhausurl:119[.]179[.]236[.]4
Malware distribution reported at 119[.]179[.]236[.]4
malware_download reported by adliwahid; status online
url
online
tags
Mozi
read the advisory ↗
3h agocorroboratedwarningThreatFoxsha256_hash:5b6b4687cc83db6c61c2fc0606176c9913fccb61237a808f76e7e46940ccbfad
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, Foxveil, haven, macOS
read the advisory ↗
3h agocorroboratedwarningThreatFoxurl:hxxps://eq[.]ajuna88[.]org/i/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
3h agoreportedwarningThreatFoxdomain:www[.]notaiomatano[.]it
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 90% confidence.
malware
ClearFake
tags
compromised, etherhide
read the advisory ↗
3h agoreportedwarningThreatFoxdomain:www[.]omniaedilizia[.]com
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 90% confidence.
malware
ClearFake
tags
compromised, etherhide
read the advisory ↗
3h agoreportedwarningThreatFoxdomain:www[.]online-ernaehrungsberatung[.]com
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 90% confidence.
malware
ClearFake
tags
compromised, etherhide
read the advisory ↗
3h agoreportedwarningThreatFoxdomain:www[.]nonsolocioccolato[.]it
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 90% confidence.
malware
ClearFake
tags
compromised, etherhide
read the advisory ↗
3h agoreportedwarningThreatFoxdomain:nowpress[.]org
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 90% confidence.
malware
ClearFake
tags
compromised, etherhide
read the advisory ↗
3h agoreportedwarningThreatFoxdomain:www[.]nuovopameka[.]it
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 90% confidence.
malware
ClearFake
tags
compromised, etherhide
read the advisory ↗
3h agoreportedwarningThreatFoxdomain:nucleus[.]ltd
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 90% confidence.
malware
ClearFake
tags
compromised, etherhide
read the advisory ↗
3h agocorroboratedwarningThreatFoxsha256_hash:0f2ea4c972c7828e01ad90902dc88a9b0943a0ce5a918a070acab8e0b7ea0830
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, chant, ClickFix, Foxveil, macOS
read the advisory ↗
3h agocorroboratedwarningThreatFoxurl:hxxps://eq[.]ajuna88[.]org/hg/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
3h agocorroboratedwarningThreatFoxsha256_hash:22c3b8cc00da98c9aa8885476942f83ffe1dbb59af53d9bcb9e77997e3650d9d
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, Foxveil, macOS, willow
read the advisory ↗
3h agocorroboratedwarningThreatFoxsha256_hash:3ce53fb4cc83cad84465296fc5b240d65f4848d3de43ac81d665419d1b62cccf
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, Foxveil, macOS, quill
read the advisory ↗
3h agocorroboratedwarningThreatFoxurl:hxxps://eq[.]ajuna88[.]org/f/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
3h agocorroboratedwarningThreatFoxurl:hxxps://eq[.]ajuna88[.]org/j/
Vidar indicator: url
botnet_cc for Vidar, reported by crep1x at 100% confidence.
malware
Vidar
tags
Vidar
read the advisory ↗
3h agoreportedwarningThreatFoxdomain:www[.]odz-lipno[.]pl
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 90% confidence.
malware
ClearFake
tags
compromised, etherhide
read the advisory ↗
3h agoreportedwarningThreatFoxdomain:www[.]officinameccanicacitrosabrina[.]it
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 90% confidence.
malware
ClearFake
tags
compromised, etherhide
read the advisory ↗
3h agoreportedwarningThreatFoxdomain:nownegah[.]com
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 90% confidence.
malware
ClearFake
tags
compromised, etherhide
read the advisory ↗
3h agoreportedwarningThreatFoxdomain:immortality[.]vg
Unknown malware indicator: domain
payload_delivery for Unknown malware, reported by anonymous at 90% confidence.
malware
Unknown malware
tags
ZigClipper
read the advisory ↗
3h agoreportedwarningThreatFoxdomain:gdyromed[.]bossbeyanadolu[.]store
ClearFake indicator: domain
payload_delivery for ClearFake, reported by anonymous at 100% confidence.
malware
ClearFake
tags
ClearFake, mac-0x68dc, macOS
read the advisory ↗
3h agoreportedwarningThreatFoxip:port:154[.]91[.]51[.]168:9097
VShell indicator: ip:port
botnet_cc for VShell, reported by anonymous at 100% confidence.
malware
VShell
tags
Vshell
read the advisory ↗
3h agoreportedwarningThreatFoxip:port:154[.]91[.]51[.]166:9097
VShell indicator: ip:port
botnet_cc for VShell, reported by anonymous at 100% confidence.
malware
VShell
tags
Vshell
read the advisory ↗
3h agoreportedwarningThreatFoxip:port:8[.]217[.]254[.]211:8888
Unknown malware indicator: ip:port
botnet_cc for Unknown malware, reported by anonymous at 100% confidence.
malware
Unknown malware
tags
Supershell
read the advisory ↗
3h agocorroboratedwarningThreatFoxdomain:bossbeyanadolu[.]store
ClearFake indicator: domain
payload_delivery for ClearFake, reported by threatcat_ch at 100% confidence.
malware
ClearFake
tags
ClearFake
read the advisory ↗
3h agocorroboratedwarningThreatFoxsha256_hash:f478683887ae70276d712dab87b65513335df9f28e6ee2fd14b1640d2bebaae5
AMOS indicator: sha256_hash
payload for AMOS, reported by c4ffeine at 100% confidence.
malware
AMOS
tags
Amos, ClickFix, forge, Foxveil, macOS
read the advisory ↗

Newest 200 reports, collapsed to one row per indicator, oldest last. Nothing on this page is a finding about this estate — it is what other people are publishing, kept so a claim can be checked against its source rather than believed.