{"success":true,"data":{"threats":[{"id":"6755e7a1-3483-4ece-8b39-e28b30f448c3","slug":"threatfox-1957968","externalId":"threatfox-1957968","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"AMOS sha256_hash: 0fa673a1cffbbabcd03249e98cd879bdfd4175ad720a2761fe89ee8dfd87c43c","description":"SHA256 hash of a malware sample (payload) indicator associated with AMOS. Indicator that identifies a malware sample (payload) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:sha256-hash","threat:payload","malware:osx-amos","confidence:100","amos","clickfix","foxveil","macos","quill"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957968/","type":"report","title":"ThreatFox IOC 1957968"},{"url":"https://www.virustotal.com/gui/file/0fa673a1cffbbabcd03249e98cd879bdfd4175ad720a2761fe89ee8dfd87c43c","type":"report","title":"Reporter reference"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:35:14.000Z","addedAt":"2026-10-08T20:48:01.976Z","updatedAt":"2026-10-08T20:48:01.976Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"2cb7ce64-ed9a-481d-83ba-8dc973600c82","slug":"threatfox-1957921","externalId":"threatfox-1957921","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"Unknown Loader domain: ikovrsps[.]com","description":"Domain name that delivers a malware payload indicator associated with Unknown Loader. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:unknown-loader","confidence:100","runelure"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957921/","type":"report","title":"ThreatFox IOC 1957921"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:12:39.000Z","addedAt":"2026-10-08T20:48:02.345Z","updatedAt":"2026-10-08T20:48:02.345Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"efce9380-0eb9-4216-bd3e-a5ff07262dd4","slug":"threatfox-1957914","externalId":"threatfox-1957914","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"Unknown Stealer sha256_hash: b449341fb97c5dd248f2091d92ad27d4dc32861ba5bc86deb0ccbbc627d4843e","description":"SHA256 hash of a malware sample (payload) indicator associated with Unknown Stealer. Indicator that identifies a malware sample (payload) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:sha256-hash","threat:payload","malware:unknown-stealer","confidence:100","loader","monero","runelure","xmrig"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957914/","type":"report","title":"ThreatFox IOC 1957914"},{"url":"https://www.virustotal.com/gui/file/b449341fb97c5dd248f2091d92ad27d4dc32861ba5bc86deb0ccbbc627d4843e/","type":"report","title":"Reporter reference"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:09:40.000Z","addedAt":"2026-10-08T20:48:02.397Z","updatedAt":"2026-10-08T20:48:02.397Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"dd2123ce-743f-47b0-b9b9-e1eef080b1f5","slug":"threatfox-1957899","externalId":"threatfox-1957899","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"Vidar url: hxxps://kl[.]3toto[.]com","description":"URL that is used for botnet Command&control (C&C) indicator associated with Vidar. Indicator that identifies a botnet command&control server (C&C) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:url","threat:botnet-cc","malware:win-vidar","confidence:100","2f3c6fb2d82ed66e2e45208cd1c7edd1","c2","loader","stealer","vidar"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957899/","type":"report","title":"ThreatFox IOC 1957899"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T20:02:22.000Z","addedAt":"2026-10-08T20:48:02.508Z","updatedAt":"2026-10-08T20:48:02.508Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"9f6a0052-aa63-40d8-9eb9-8c815bb0d079","slug":"threatfox-1957898","externalId":"threatfox-1957898","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"Aisuru ip:port: 165[.]22[.]244[.]100:8443","description":"ip:port combination that is used for botnet Command&control (C&C) indicator associated with Aisuru. Indicator that identifies a botnet command&control server (C&C) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:ip-port","threat:botnet-cc","malware:elf-aisuru","confidence:100","aisuru","c2"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957898/","type":"report","title":"ThreatFox IOC 1957898"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T19:54:34.000Z","addedAt":"2026-10-08T20:48:02.515Z","updatedAt":"2026-10-08T20:48:02.515Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"1a2a190e-499a-4069-965a-5dbf8f59627e","slug":"threatfox-1957872","externalId":"threatfox-1957872","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"AMOS sha256_hash: 0a3cf154d156699a87a6592e859249ca2f689452d8608cdef18d0d84177f1649","description":"SHA256 hash of a malware sample (payload) indicator associated with AMOS. Indicator that identifies a malware sample (payload) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:sha256-hash","threat:payload","malware:osx-amos","confidence:100","amos","clickfix","foxveil","macos","quill"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957872/","type":"report","title":"ThreatFox IOC 1957872"},{"url":"https://www.virustotal.com/gui/file/0a3cf154d156699a87a6592e859249ca2f689452d8608cdef18d0d84177f1649","type":"report","title":"Reporter reference"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T19:42:18.000Z","addedAt":"2026-10-08T19:45:52.517Z","updatedAt":"2026-10-08T20:48:02.727Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"0a3f78f6-2bcc-44ec-931b-60df90d30d04","slug":"threatfox-1957871","externalId":"threatfox-1957871","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"Remcos ip:port: 128[.]90[.]113[.]76:3000","description":"ip:port combination that is used for botnet Command&control (C&C) indicator associated with Remcos. Indicator that identifies a botnet command&control server (C&C) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:ip-port","threat:botnet-cc","malware:win-remcos","confidence:100","c2","remcos","star-baby-27"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957871/","type":"report","title":"ThreatFox IOC 1957871"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T19:42:18.000Z","addedAt":"2026-10-08T19:35:12.205Z","updatedAt":"2026-10-08T20:48:02.719Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"a01b1f7f-dfb5-4ed4-9fe6-c5ff8bbc0c0c","slug":"threatfox-1957870","externalId":"threatfox-1957870","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"IClickFix domain: fri-dod-01[.]cfd","description":"Domain name that delivers a malware payload indicator associated with IClickFix. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:js-iclickfix","confidence:100","clickfix"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957870/","type":"report","title":"ThreatFox IOC 1957870"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T19:24:17.000Z","addedAt":"2026-10-08T19:35:12.215Z","updatedAt":"2026-10-08T20:48:02.734Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"4a8a4662-f50a-4fc1-aedc-f0cefb6e85c1","slug":"threatfox-1957847","externalId":"threatfox-1957847","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"VShell ip:port: 130[.]94[.]93[.]147:8443","description":"ip:port combination that is used for botnet Command&control (C&C) indicator associated with VShell. Indicator that identifies a botnet command&control server (C&C) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:ip-port","threat:botnet-cc","malware:win-vshell","confidence:100","vshell"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957847/","type":"report","title":"ThreatFox IOC 1957847"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T19:05:06.000Z","addedAt":"2026-10-08T19:35:12.393Z","updatedAt":"2026-10-08T20:48:02.913Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"c5ecc0f5-9e3b-4ab0-97b8-74673305a86a","slug":"threatfox-1957846","externalId":"threatfox-1957846","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"Unknown malware ip:port: 5[.]180[.]27[.]57:7443","description":"ip:port combination that is used for botnet Command&control (C&C) indicator associated with Unknown malware. Indicator that identifies a botnet command&control server (C&C) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:ip-port","threat:botnet-cc","malware:unknown","confidence:100","mythic"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957846/","type":"report","title":"ThreatFox IOC 1957846"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T19:05:06.000Z","addedAt":"2026-10-08T19:35:12.385Z","updatedAt":"2026-10-08T20:48:02.906Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"65f6949c-35b2-4234-836e-61c317ec9ab5","slug":"threatfox-1957841","externalId":"threatfox-1957841","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"Aisuru ip:port: 178[.]16[.]53[.]68:8080","description":"ip:port combination that is used for botnet Command&control (C&C) indicator associated with Aisuru. Indicator that identifies a botnet command&control server (C&C) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:ip-port","threat:botnet-cc","malware:elf-aisuru","confidence:100","aisuru","c2"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957841/","type":"report","title":"ThreatFox IOC 1957841"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T19:01:51.000Z","addedAt":"2026-10-08T19:35:12.408Z","updatedAt":"2026-10-08T20:48:02.929Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"0beed93a-6d95-40c7-9f83-d85dbcfe7ff1","slug":"threatfox-1957844","externalId":"threatfox-1957844","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"Drifter ip:port: 93[.]152[.]221[.]45:44308","description":"ip:port combination that is used for botnet Command&control (C&C) indicator associated with Drifter. Indicator that identifies a botnet command&control server (C&C) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:ip-port","threat:botnet-cc","malware:elf-drifter","confidence:100","android","botnet","ddos","dongfeng","drifter"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957844/","type":"report","title":"ThreatFox IOC 1957844"},{"url":"https://github.com/deepfield/public-research/tree/main/drifter","type":"report","title":"Reporter reference"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T18:52:44.000Z","addedAt":"2026-10-08T19:35:12.417Z","updatedAt":"2026-10-08T20:48:02.936Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"5c8dfe13-c0fc-4182-988a-0a2e25a76790","slug":"threatfox-1957843","externalId":"threatfox-1957843","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"ClearFake domain: lacek[.]store","description":"Domain name that delivers a malware payload indicator associated with ClearFake. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:js-clearfake","confidence:100","clearfake"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957843/","type":"report","title":"ThreatFox IOC 1957843"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T18:49:26.000Z","addedAt":"2026-10-08T19:35:12.424Z","updatedAt":"2026-10-08T20:48:02.944Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"2cbf3a03-5792-4d07-9b05-536281bacca1","slug":"threatfox-1957839","externalId":"threatfox-1957839","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"AMOS sha256_hash: 149b0894f5d5a376c58fc72011370a350a4bd17a5521f2ab211ac96ac728ffbb","description":"SHA256 hash of a malware sample (payload) indicator associated with AMOS. Indicator that identifies a malware sample (payload) Reporter confidence 100%. Last seen 2026-10-08 18:26:25 UTC.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:sha256-hash","threat:payload","malware:osx-amos","confidence:100","amos","clickfix","foxveil","macos","quill"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957839/","type":"report","title":"ThreatFox IOC 1957839"},{"url":"https://www.virustotal.com/gui/file/149b0894f5d5a376c58fc72011370a350a4bd17a5521f2ab211ac96ac728ffbb","type":"report","title":"Reporter reference"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T18:27:46.000Z","addedAt":"2026-10-08T18:41:57.483Z","updatedAt":"2026-10-08T20:48:02.959Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"d8d0afca-c275-44f0-ac59-561a239ea592","slug":"threatfox-1957840","externalId":"threatfox-1957840","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"ClearFake domain: keca[.]store","description":"Domain name that delivers a malware payload indicator associated with ClearFake. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:js-clearfake","confidence:100","clearfake"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957840/","type":"report","title":"ThreatFox IOC 1957840"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T18:27:08.000Z","addedAt":"2026-10-08T18:41:57.493Z","updatedAt":"2026-10-08T20:48:02.966Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"79ea75de-0ff5-4282-9de7-0340d847fc53","slug":"threatfox-1957835","externalId":"threatfox-1957835","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"Remcos ip:port: 172[.]94[.]58[.]29:2303","description":"ip:port combination that is used for botnet Command&control (C&C) indicator associated with Remcos. Indicator that identifies a botnet command&control server (C&C) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:ip-port","threat:botnet-cc","malware:win-remcos","confidence:100","c2","remcos","winprotection2"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957835/","type":"report","title":"ThreatFox IOC 1957835"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T18:20:52.000Z","addedAt":"2026-10-08T18:41:57.500Z","updatedAt":"2026-10-08T20:48:02.974Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"bcf6892f-8a09-433d-afa2-530d00f85e51","slug":"threatfox-1957834","externalId":"threatfox-1957834","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"Unknown Loader domain: coppertrack[.]cfd","description":"Domain that is used for botnet Command&control (C&C) indicator associated with Unknown Loader. Indicator that identifies a botnet command&control server (C&C) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:botnet-cc","malware:unknown-loader","confidence:100","offloader"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957834/","type":"report","title":"ThreatFox IOC 1957834"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T18:10:44.000Z","addedAt":"2026-10-08T18:41:57.528Z","updatedAt":"2026-10-08T20:48:03.009Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"0f865d78-2a65-43a2-903c-5306fbb8f971","slug":"threatfox-1957832","externalId":"threatfox-1957832","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"ClearFake domain: fluszoif[.]sulaf[.]store","description":"Domain name that delivers a malware payload indicator associated with ClearFake. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:js-clearfake","confidence:100","clearfake","mac-0xdcf2","macos"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957832/","type":"report","title":"ThreatFox IOC 1957832"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T18:04:37.000Z","addedAt":"2026-10-08T18:41:57.543Z","updatedAt":"2026-10-08T20:48:03.025Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"fd007a8c-8cc3-44bb-aa43-679ccf771b98","slug":"threatfox-1957643","externalId":"threatfox-1957643","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"FAKEUPDATES domain: fast-api[.]thelist2win[.]org","description":"Domain that is used for botnet Command&control (C&C) indicator associated with FAKEUPDATES. Indicator that identifies a botnet command&control server (C&C) Reporter confidence 100%.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:botnet-cc","malware:js-fakeupdates","confidence:100","socgholish"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957643/","type":"report","title":"ThreatFox IOC 1957643"},{"url":"https://infosec.exchange/@monitorsg/117406389908017971","type":"report","title":"Reporter reference"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T17:58:23.000Z","addedAt":"2026-10-08T17:41:58.743Z","updatedAt":"2026-10-08T20:48:03.054Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]},{"id":"8c209c1f-2e21-4060-94f8-02aeb8a7b4f9","slug":"threatfox-1957642","externalId":"threatfox-1957642","source":"abuse.ch ThreatFox","sourceType":"community","type":"indicator","title":"KongTuke domain: haergreve[.]lol","description":"Domain name that delivers a malware payload indicator associated with KongTuke. Indicator that identifies a malware distribution server (payload delivery) Reporter confidence 100%. Last seen 2026-10-08 20:11:33 UTC.","cveId":null,"cvssScore":null,"cvssVector":null,"severity":"unknown","vendor":null,"product":null,"affectedVersions":[],"cwes":[],"tags":["threatfox","ioc","ioc:domain","threat:payload-delivery","malware:js-kongtuke","confidence:100","kongtuke"],"relatedCves":[],"titleFingerprint":null,"countryCodes":[],"knownExploited":false,"patchAvailable":false,"patchLinks":[],"references":[{"url":"https://threatfox.abuse.ch/ioc/1957642/","type":"report","title":"ThreatFox IOC 1957642"}],"epssScore":null,"epssPercentile":null,"nucleiTemplatePath":null,"nucleiSeverity":null,"enrichment":null,"publishedAt":"2026-10-08T17:58:22.000Z","addedAt":"2026-10-08T17:41:58.750Z","updatedAt":"2026-10-08T20:48:03.062Z","epssUpdatedAt":null,"nucleiUpdatedAt":null,"links":[]}],"pagination":{"page":1,"limit":20,"total":37485,"totalPages":1875,"hasNext":true,"hasPrev":false}},"meta":{"apiVersion":"v1","requestedAt":"2026-10-08T23:58:19.895Z","durationMs":230,"filters":{"search":null,"severity":[],"type":[],"country":[],"tag":["confidence:100"],"cwe":[],"vendor":null,"product":null,"cve":null,"source":[],"days":null,"publishedAfter":null,"publishedBefore":null,"minCvss":null,"maxCvss":null,"minEpss":null,"knownExploited":null,"hasPatch":null,"hasNucleiTemplate":null},"sort":"newest","unknownParams":[],"warnings":[]}}