← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
OSINT Volley 2026-01-29 - Meterpreter/Vidar/Cobalt Strike
Automated OSINT sweep from ThreatFox. Top malware: Meterpreter(69), Vidar(31), Cobalt Strike(22), Unknown malware(13), Remcos(11). Source: abuse.ch ThreatFox API. SSL enriched: 26 IPs with HTTPS, 15 self-signed (C2 candidates). Pattern 54: sweep→volley automation.
MITRE ATT&CK & Malware Families
| TYPE | INDICATOR | DESCRIPTION | CREATED | |
|---|---|---|---|---|
| URL | https://cdn.jsdelivr.net/gh/grading-chatter-dock73/super-docs-web3/sdf | ThreatFox: ClearFake - payload_delivery | 2026-01-29 | |
| hostname | th3hunt3r-53504.portmap.host | ThreatFox: XWorm - botnet_cc | 2026-01-29 | |
| URL | http://144.172.106.251/ | ThreatFox: Unknown malware - botnet_cc | 2026-01-29 | |
| URL | https://cdn.jsdelivr.net/gh/relight-73-unsigned/tk-hz-ctrl/ypfcbjy5exc2pzs4bc7j | ThreatFox: ClearFake - payload_delivery | 2026-01-29 | |
| URL | https://34ten.com/ | ThreatFox: Unknown malware - payload_delivery | 2026-01-29 | |
| domain | deeyou.xyz | ThreatFox: Cobalt Strike - botnet_cc | 2026-01-29 | |
| hostname | www.carhartt-market.com | ThreatFox: Cobalt Strike - botnet_cc | 2026-01-29 | |
| hostname | dnsuptime.dns.army | ThreatFox: VShell - botnet_cc | 2026-01-29 | |
| hostname | csp.cloudvaly.com | ThreatFox: Vidar - botnet_cc | 2026-01-29 | |
| hostname | csp.beznervov.com | ThreatFox: Vidar - botnet_cc | 2026-01-29 | |
| URL | https://csp.cloudvaly.com/ | ThreatFox: Vidar - botnet_cc | 2026-01-29 | |
| URL | https://csp.beznervov.com/ | ThreatFox: Vidar - botnet_cc | 2026-01-29 | |
| hostname | projectindia999.loseyourip.com | ThreatFox: Nanocore RAT - botnet_cc | 2026-01-29 | |
| hostname | cia.anondns.net | ThreatFox: Nanocore RAT - botnet_cc | 2026-01-29 | |
| hostname | skittlesforlife.anondns.net | ThreatFox: Nanocore RAT - botnet_cc | 2026-01-29 | |
| hostname | suzrbgndb.localto.net | ThreatFox: SpyNote - botnet_cc | 2026-01-29 | |
| hostname | ecolombia223.casacam.net | ThreatFox: AsyncRAT - botnet_cc | 2026-01-29 | |
| domain | atlnewmedia.com | ThreatFox: XWorm - botnet_cc | 2026-01-29 | |
| domain | arenalexperience.com | ThreatFox: XWorm - botnet_cc | 2026-01-29 | |
| hostname | mikey12325ja1-31716.portmap.host | ThreatFox: XWorm - botnet_cc | 2026-01-29 | |
| hostname | yoga.tatatech.net | ThreatFox: FAKEUPDATES - botnet_cc | 2026-01-29 | |
| hostname | nra.uk.com | ThreatFox: AsyncRAT - botnet_cc | 2026-01-29 | |
| hostname | jwwp.cn.com | ThreatFox: AsyncRAT - botnet_cc | 2026-01-29 | |
| hostname | d8zljb.ru.com | ThreatFox: AsyncRAT - botnet_cc | 2026-01-29 | |
| hostname | changingcanoes.us.com | ThreatFox: AsyncRAT - botnet_cc | 2026-01-29 | |
| hostname | asianswitch.gb.net | ThreatFox: AsyncRAT - botnet_cc | 2026-01-29 | |
| hostname | mail.onetime-authentication.cruiserscrib.com | ThreatFox: Unknown malware - botnet_cc | 2026-01-29 | |
| URL | https://banengids.com/5g7h.js | ThreatFox: KongTuke - payload_delivery | 2026-01-29 | |
| domain | banengids.com | ThreatFox: KongTuke - payload_delivery | 2026-01-29 | |
| URL | https://banengids.com/js.php | ThreatFox: KongTuke - payload_delivery | 2026-01-29 | |
| domain | globaljira.com | ThreatFox: SmartApeSG - payload_delivery | 2026-01-29 | |
| URL | https://globaljira.com/token/handler-fetch.php | ThreatFox: SmartApeSG - payload_delivery | 2026-01-29 | |
| URL | https://globaljira.com/token/middleware-render.js | ThreatFox: SmartApeSG - payload_delivery | 2026-01-29 | |
| URL | http://193.42.38.42/rate | ThreatFox: SmartApeSG - payload_delivery | 2026-01-29 | |
| URL | https://immortalexser.com/rate | ThreatFox: SmartApeSG - payload_delivery | 2026-01-29 | |
| URL | https://193.42.38.42/limit | ThreatFox: SmartApeSG - payload_delivery | 2026-01-29 | |
| hostname | gty.cloudvaly.com | ThreatFox: Vidar - botnet_cc | 2026-01-29 | |
| hostname | gty.beznervov.com | ThreatFox: Vidar - botnet_cc | 2026-01-29 | |
| URL | https://gty.beznervov.com/ | ThreatFox: Vidar - botnet_cc | 2026-01-29 | |
| URL | https://gty.cloudvaly.com/ | ThreatFox: Vidar - botnet_cc | 2026-01-29 | |
| hostname | static.cos-tencent.cloud | ThreatFox: Cobalt Strike - botnet_cc | 2026-01-29 | |
| hostname | img2.huorongsec.com | ThreatFox: Cobalt Strike - botnet_cc | 2026-01-29 | |
| URL | http://213.176.72.208 | ThreatFox: Stealc - botnet_cc | 2026-01-29 | |
| URL | http://158.94.211.91/health | ThreatFox: Unknown Stealer - botnet_cc | 2026-01-29 | |
| URL | http://158.94.211.91/dd0e7ee6f5e1af92436a3a938660db61/txvhf.irrz | ThreatFox: Unknown Stealer - botnet_cc | 2026-01-29 | |
| domain | kernel-compass.com | ThreatFox: SantaStealer - botnet_cc | 2026-01-29 | |
| URL | https://kernel-compass.com/ | ThreatFox: SantaStealer - botnet_cc | 2026-01-29 | |
| URL | http://91.219.237.175/m4dfhweEw/Login.php | ThreatFox: Amadey - botnet_cc | 2026-01-29 | |
| hostname | them-choose.gl.at.ply.gg | ThreatFox: Quasar RAT - botnet_cc | 2026-01-29 | |
| URL | http://5.181.86.244 | ThreatFox: Amadey - botnet_cc | 2026-01-29 | |
| domain | daroughgan.com | ThreatFox: Remcos - botnet_cc | 2026-01-29 | |
| hostname | daroughgan8hajous5.duckdns.org | ThreatFox: Remcos - botnet_cc | 2026-01-29 | |
| hostname | daroughgan8hajous4.duckdns.org | ThreatFox: Remcos - botnet_cc | 2026-01-29 | |
| hostname | daroughgan8hajous3.duckdns.org | ThreatFox: Remcos - botnet_cc | 2026-01-29 | |
| hostname | daroughgan8hajous2.duckdns.org | ThreatFox: Remcos - botnet_cc | 2026-01-29 | |
| hostname | daroughgan8hajous1.duckdns.org | ThreatFox: Remcos - botnet_cc | 2026-01-29 | |
| hostname | zaryef.za.com | ThreatFox: Quasar RAT - botnet_cc | 2026-01-29 | |
| hostname | uber.gr.com | ThreatFox: Quasar RAT - botnet_cc | 2026-01-29 | |
| hostname | sri.gb.net | ThreatFox: Quasar RAT - botnet_cc | 2026-01-29 | |
| hostname | leivistabaltic.eu.com | ThreatFox: Quasar RAT - botnet_cc | 2026-01-29 | |
| domain | hoianorchidgarden.com | ThreatFox: Quasar RAT - botnet_cc | 2026-01-29 | |
| URL | https://cdn.jsdelivr.net/gh/grading-chatter-dock73/vigilant-bucket-gui/p1lot | ThreatFox: ClearFake - payload_delivery | 2026-01-29 | |
| URL | https://cdn.jsdelivr.net/gh/grading-chatter-dock73/sassy-generous-drv9/wrap1q | ThreatFox: ClearFake - payload_delivery | 2026-01-29 | |
| domain | szdxmm-ydbaoji0126.com | ThreatFox: ValleyRAT - botnet_cc | 2026-01-29 | |
| domain | szdxmm-yd0126.com | ThreatFox: ValleyRAT - botnet_cc | 2026-01-29 | |
| hostname | gohapel398-62132.portmap.host | ThreatFox: Quasar RAT - botnet_cc | 2026-01-29 | |
| hostname | act-tingly.gl.at.ply.gg | ThreatFox: XWorm - botnet_cc | 2026-01-29 | |
| URL | http://138.226.236.148 | ThreatFox: Stealc - botnet_cc | 2026-01-29 |