不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2025/10/17
※2025/10/17 更新
マルウェア感染させると考えられるURLを検知（2025/10/17）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://velvet[.]wqix-5[.]ru/75[.]google?t=9kr5yaja hxxps://flint[.]wqix-5[.]ru/3j[.]check?t=gqh8sgha hxxps://saffron[.]wtok-2[.]ru/t8[.]check?t=3futtoi7 hxxps://topaz[.]mcej-9[.]ru/btc[.]check?t=9ot8ga7k hxxps://car[.]gdyl-2[.]ru/13[.]google?t=ouevulko hxxps://slash[.]gdyl-2[.]ru/nuj[.]check?t=v4b7nqz9 hxxps://war[.]rjuq-3[.]ru/ed[.]check?t=ipxegror hxxps://glue[.]rjuq-3[.]ru/7ftx2kjb hxxps://water[.]4i1e2[.]ru/0xq[.]google?t=sldkyxfe hxxps://t1qh[.]te7ap[.]online/5hkuj2gjqb[.]sh hxxps://t1qh[.]te7ap[.]online/oez9wm04xu[.]sh hxxps://fire[.]bvuf-2[.]ru/9y[.]check?t=117u2t9i hxxps://kz8m[.]te7ap[.]online/fn41qmip5k[.]sh hxxps://path[.]4i1e2[.]ru/t39[.]check?t=4dv2xywx hxxps://qd[.]nqyf-7[.]ru/c0[.]check?t=kaph4vvm hxxps://forest[.]4i1e2[.]ru/q7p[.]check?t=h476fktt hxxps://c7qv[.]te7ap[.]online/f1pcv1xrgk[.]sh hxxps://c7qv[.]te7ap[.]online/9sx3filxls[.]sh hxxps://storm[.]bvuf-2[.]ru/sr[.]check?t=erzxtlhl hxxps://stone[.]4i1e2[.]ru/u8[.]google?t=xogb5hkw hxxps://m0yl[.]te7ap[.]online/b6oqe6r6d5[.]sh hxxps://m0yl[.]te7ap[.]online/j92jqsq7f7[.]sh hxxps://wolf[.]8u2a9[.]ru/f1[.]google?t=oqm93t0j hxxps://leaf[.]4i1e2[.]ru/m4d[.]check?t=b44t798a hxxps://vr4x[.]te7ap[.]online/hrlyafko8q[.]sh hxxps://rain[.]4i1e2[.]ru/w1m3[.]google?t=ouj6dubf hxxps://xq74[.]fi7em[.]online/2hj6j7ts12[.]sh hxxps://tree[.]bvuf-2[.]ru/ii8[.]check?t=h8nh3c9v hxxps://forest[.]bvuf-2[.]ru/ye[.]google?t=kesomg7m hxxps://hd3n[.]fi7em[.]online/vdbdk6bgos[.]sh hxxps://sun[.]8u2a9[.]ru/4q[.]google?t=r7heegpf hxxps://q4xn[.]te7ap[.]online/a4atbxyz6z[.]sh hxxps://q4xn[.]te7ap[.]online/cqcio57lzw[.]sh hxxps://cloud[.]8u2a9[.]ru/9rz[.]check?t=6hkftbaq hxxps://zn8c[.]fi7em[.]online/k1x90n22x0[.]sh hxxps://u7j[.]wir-2[.]ru/6jt[.]check?t=lys5n4mb hxxps://9t4[.]wir-2[.]ru/fy[.]check?t=gsxm9304 hxxps://p3za[.]fi7em[.]online/ungfbg5jn0[.]sh hxxps://3r[.]bid-5[.]ru/ru1[.]check?t=psguvghh hxxps://p3za[.]fi7em[.]online/4hkr4ptk70[.]sh hxxps://w8v[.]bid-5[.]ru/0x[.]google?t=sbxoosd0 hxxps://z2[.]bid-5[.]ru/rl[.]check?t=5jr0660k hxxps://b5uk[.]fi7em[.]online/53mxp83k3v[.]sh hxxps://w9pl[.]ko0um[.]online/b6f7m4b0hg[.]sh hxxps://stone[.]vbep-3[.]ru/ghn[.]google?t=ybemq28x hxxps://fire[.]8y7o4[.]ru/yn[.]google?t=0isd0ros hxxps://w9pl[.]ko0um[.]online/dkelv6bb7u[.]sh hxxps://book[.]1a2e6[.]ru/3r[.]check?t=1mwc4b23 hxxps://f6rx[.]ko0um[.]online/2e6tx3moi1[.]sh hxxps://mv[.]wir-2[.]ru/4toiqx2v hxxps://mv[.]wir-2[.]ru/4z[.]google?t=4aw6so0e hxxps://f6rx[.]ko0um[.]online/e6dhad6jjv[.]sh hxxps://y1dk[.]fi7em[.]online/ddugmdmhtb[.]sh hxxps://932[.]wir-2[.]ru/47u[.]google?t=u7p9cy5p hxxps://t9k[.]wir-2[.]ru/sr[.]check?t=m6dop8tx hxxps://zn8c[.]fi7em[.]online/xu6gbriz5o[.]sh hxxps://g0qm[.]ko0um[.]online/3gdcj3onqt[.]sh hxxps://light[.]vbep-3[.]ru/8f[.]google?t=z5bwx6ch hxxps://boat[.]ndoq-0[.]ru/3s[.]google?t=pseaa359 hxxps://r2vy[.]ko0um[.]online/0rxndwhpgj[.]sh hxxps://cloud[.]8y7o4[.]ru/m3[.]google?t=jvjutuyg hxxps://r2vy[.]ko0um[.]online/7so4d9fhb5[.]sh hxxps://wave[.]ndoq-0[.]ru/r7h[.]check?t=tggeynh3 hxxps://lt7d[.]ko0um[.]online/dy9ds14jy1[.]sh hxxps://stone[.]ndoq-0[.]ru/89[.]check?t=a3kwupyn hxxps://lt7d[.]ko0um[.]online/2n5onktrob[.]sh hxxps://rice[.]vbep-3[.]ru/egf68z5d hxxps://t1mze9[.]fox-ab[.]ru/yg59rjfg |
ClearFake |
| URL | hxxps://api[.]telegram[.]org/bot8213955459:AAFkRRpS_Ak9dj8irLZNR_S3HPRGBL45XdQ/sendMessage?chat_id=5489131379 | MASS Logger |
| URL | hxxp://185[.]164[.]59[.]38/12/indevout[.]exe hxxp://107[.]189[.]17[.]242/7a86d8aa76374f16[.]php hxxp://185[.]164[.]59[.]38/12/houselet[.]exe |
Stealc |
| URL | hxxp://178[.]16[.]55[.]189/files/1371132119/hondgja[.]exe hxxp://178[.]16[.]55[.]189/files/7912960477/bzfVW9A[.]exe |
Coinminer |
| URL | hxxps://176[.]46[.]141[.]5/gateway/4hl0nqt9[.]0rlra hxxp://178[.]16[.]55[.]189/files/8167064937/B0zaO6U[.]exe hxxp://178[.]16[.]53[.]7/rad[.]exe |
Rhadamanthys |
| URL | hxxp://178[.]16[.]53[.]7/s[.]exe | Amadey |
| URL | hxxp://23[.]95[.]245[.]178/kbt1/y1006[.]exe | DarkVision RAT |
| URL | hxxp://178[.]16[.]55[.]189/files/1760829628/N2HlqRs[.]exe | HijackLoader |
| URL | hxxp://178[.]16[.]55[.]189/files/8042875554/o0T15dI[.]bat | Quasar RAT |
| URL | hxxp://48[.]209[.]82[.]191/ns[.]exe hxxp://48[.]209[.]82[.]191/hele[.]exe |
AsyncRAT |
| URL | hxxp://64[.]188[.]98[.]163/9[.]exe | Agent Tesla |
| URL | hxxp://64[.]188[.]98[.]163/xdwd[.]exe hxxp://178[.]16[.]55[.]189/files/7933012987/kuawB3y[.]exe |
SalatStealer |
| URL | hxxps://api[.]telegram[.]org/bot8346805594:AAGsIRp3rLvU8A2GduxJawXH5n9M3aFdg2M/sendMessage?chat_id=6311012313 | DarkCloud |
| URL | hxxp://178[.]16[.]54[.]37/fire/wormb[.]txt | XWorm |
| URL | hxxps://quicolozada[.]online/doge/optimized_MSI[.]png hxxp://23[.]95[.]103[.]208/img/ksms/sc9ddc73jjhfjsh8cxs0d9xc23hjhj5j6jhj8bh876hfdf90gd900vb90brt90t0yr09asd03sfd0f0sd[.]hta hxxp://84[.]38[.]134[.]12/380/msidfi9sd0fgdfkgjdfg00fdg034dfgkdfkgj9fdg934fdghdff9gd9fg9fd[.]hta hxxps://quicolozada[.]online/arquivo_20251015234338[.]txt hxxps://quicolozada[.]online/arquivo_20251015234809[.]txt |
Remcos |
| URL | hxxps://mnbvcxz[.]biz/angel/five/fre[.]php hxxp://mnbvcxz[.]biz/angel/five/fre[.]php hxxp://www[.]copent[.]net/black/coded/logs/fre[.]php |
LokiBot |
| URL | hxxps://pcdcinc[.]com/6n7n[.]js hxxps://pcdcinc[.]com/js[.]php |
KongTuke |
| URL | hxxp://178[.]16[.]55[.]189/files/7912960477/sgkU7ru[.]exe | Nanocore RAT |
