不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様17社 -
2026/03/02
※2026/03/02 更新
マルウェア感染させると考えられるURLを検知（2026/03/02）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://186[.]169[.]75[.]221/a[.]exe hxxp://186[.]169[.]75[.]221/SOSTENER[.]js hxxp://186[.]169[.]75[.]221/SOSTENER[.]bat hxxps://talentaclub[.]com/build/ckSogSn[.]txt |
Remcos |
| URL | hxxp://77[.]90[.]185[.]24/d/roberto83278 hxxps://l3jvnuw2[.]smartcanvas[.]digital/?=check&&actmn=QuwIZyBsWUGgLPBu hxxps://2azr2jei[.]coreforge[.]digital/?=check&&actmn=LacBCiCFwzBsDApE hxxps://gaos1opo[.]dataspark[.]digital/?=check&&actmn=qtzxxtXjaZzjZveQ hxxps://4sontfzx[.]quantumloop[.]digital/?=check&&actmn=vspoFTvpBCFfsGMz hxxps://5w2x7glx[.]pixelpeak[.]digital/?=check&&actmn=ADUOUQvjCIDAlbbB hxxps://gnchdcvq[.]webweave[.]digital/?=check&&actmn=NjuHxFSyvBQJPyck hxxps://95zxw7vw[.]opticprime[.]digital/?=check&&actmn=rufFmwLCMcraKwPc hxxps://zpcm9g8o[.]synthgrid[.]digital/?=check&&actmn=pFOVCVhppWoSjXuB hxxps://ww1xqffa[.]cyberlens[.]digital/?=check&&actmn=iEFprNLGKBmIWfPX hxxps://q8dmuuna[.]optiweave[.]digital/?=check&&actmn=iUOXryTSdBbSpZdh hxxps://z2wx6ccc[.]cortexforge[.]digital/?=check&&actmn=SebVSZxrnZLeoqig hxxps://dmv2ddsm[.]mozillacola[.]digital/?=check&&actmn=vyjrKGakWSQaNLIO hxxps://r0e3fpkc[.]operafanta[.]digital/?=check&&actmn=HAsmZIwTPKMMRyIx hxxps://kn1kwx56[.]chromepepsi[.]digital/?=check&&actmn=hHRTlUlMnnyUpwMl hxxps://o90zx8u6[.]vivaldisprite[.]digital/?=check&&actmn=FFlAYjhGNvIEDTts hxxps://xmes67am[.]safaricola[.]digital/?=check&&actmn=nLjqEQRFnMVHlqtn hxxps://1lf2pz2k[.]bravepepsi[.]digital/?=check&&actmn=PzbHFHutHqXXlckM hxxps://y6ryee05[.]edgemirinda[.]digital/?=check&&actmn=unpyPtpGSzSWCYHJ hxxps://r3ulx0ht[.]vivaldicoke[.]digital/?=check&&actmn=aJvdwQbuIczacozp hxxps://vnm2ey0a[.]coldglass[.]digital/?=check&&actmn=sZmhLqdSmyIyQhOE |
ClearFake |
| URL | hxxp://130[.]12[.]180[.]43/files/7290860719/OWG82sl[.]exe hxxp://130[.]12[.]180[.]43/files/7290860719/bLcXzlH[.]exe hxxp://130[.]12[.]180[.]43/files/use/random[.]msi hxxp://130[.]12[.]180[.]43/files/6608710704/6url4X8[.]exe hxxp://vinievent[.]com/venv/build[.]exe hxxp://130[.]12[.]180[.]43/files/5924614076/ehstua1[.]exe hxxp://130[.]12[.]180[.]43/files/7782139129/0qrULDD[.]exe hxxp://185[.]182[.]82[.]13/1[.]exe |
Vidar |
| URL | hxxps://wuliaox[.]com/2g5a[.]js hxxps://wuliaox[.]com/js[.]php hxxps://nicorica[.]com/8g5f[.]js hxxps://nicorica[.]com/js[.]php |
KongTuke |
| URL | hxxp://77[.]90[.]185[.]66:6677/IRemotePanel | RedLine Stealer |
| URL | hxxp://sbstorage[.]cfd/Chrome[.]js | Loda |
| URL | hxxps://stradisamplix[.]com/api/data/receive hxxps://api[.]aloparatoriuz[.]com/LokwiUHhajhWnbX |
AMOS |
| URL | hxxps://lun[.]marvek[.]live/LunX[.]zip | PureCrypter |
| URL | hxxp://91[.]232[.]103[.]250/color[.]exe hxxp://94[.]154[.]32[.]195/killxd[.]bat hxxps://94[.]154[.]32[.]195/killxd[.]bat hxxps://roverbot[.]info/killxd[.]bat hxxp://roverbot[.]info/killxd[.]bat hxxp://91[.]232[.]103[.]250/cs2[.]exe |
Quasar RAT |
| URL | hxxp://213[.]176[.]73[.]162/api/NTE3YjdjNWU1NjYzNjU2YTA1N2Y= hxxp://89[.]169[.]12[.]245/api/NTE3YjdjNWU1NjYzNjU2YTA1N2Y= hxxp://213[.]176[.]73[.]160/api/NTE3YjdjNWU1NjYzNjU2YTA1N2Y= |
SmartLoader |
| URL | hxxps://www[.]kotojuki[.]com/upload/upl/aIh2Q8_tdPWA9w6hskn5/539869[.]pdf | Formbook |
| URL | hxxps://eyasinarafat[.]com/wp-admin/js/opkarig[.]txt hxxps://sunchernical[.]com/2026/blessed/SECURED[.]ps1 hxxps://api[.]telegram[.]org/bot8504747988:AAH_GcXbH95UWRmzt28C-ogSaDKKJ6mAFVc/sendMessage?chat_id=7629232865 hxxps://api[.]telegram[.]org/bot8320970646:AAEgpgXUIqz6CauKIh_qhunCp02QX4AnWVA/sendMessage?chat_id=7659024350 hxxps://api[.]telegram[.]org/bot8461650623:AAFb-xKvWkk0AhlBlZcaynxfxcVxlAjwd4I/sendMessage?chat_id=8069327382 |
Stealerium |
| URL | hxxps://yaso[.]su/raw/UpxC8OJX | Snake Keylogger |
| URL | hxxp://45[.]128[.]118[.]140/bot_x86[.]exe | Lumma Stealer |
| URL | hxxp://82[.]25[.]63[.]1/9f53354de2964d8b[.]php hxxps://5[.]75[.]232[.]223/5065bfaf5315fdfb[.]php hxxps://82[.]25[.]63[.]1/9f53354de2964d8b[.]php |
Stealc |
| URL | hxxp://8[.]138[.]112[.]209:1112/02[.]08[.]2022[.]exe hxxp://121[.]43[.]58[.]124:4444/02[.]08[.]2022[.]exe hxxp://38[.]180[.]152[.]140:8888/02[.]08[.]2022[.]exe hxxp://86[.]106[.]143[.]213/02[.]08[.]2022[.]exe hxxp://59[.]110[.]40[.]60:8443/02[.]08[.]2022[.]exe hxxp://38[.]180[.]152[.]34:8888/02[.]08[.]2022[.]exe hxxp://156[.]224[.]28[.]186/02[.]08[.]2022[.]exe hxxp://66[.]154[.]110[.]34/02[.]08[.]2022[.]exe hxxp://66[.]42[.]56[.]151:4444/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxp://64[.]89[.]163[.]109/kirk[.]armv4l hxxp://64[.]89[.]163[.]109/kirk[.]i586 hxxp://64[.]89[.]163[.]109/kirk[.]powerpc-440fp hxxp://64[.]89[.]163[.]109/kirk[.]powerpc hxxp://64[.]89[.]163[.]109/kirk[.]armv7l hxxp://64[.]89[.]163[.]109/kirk[.]sparc hxxp://64[.]89[.]163[.]109/kirk[.]x86_64 hxxp://130[.]12[.]180[.]124/fit075kmyvo3/assets/js/88296p2ett hxxp://130[.]12[.]180[.]124/fit075kmyvo3/assets/js/8cb7qpuydx hxxp://130[.]12[.]180[.]124/fit075kmyvo3/assets/js/8iwks17l9s |
Bashlite |
| URL | hxxp://192[.]109[.]200[.]63/reload hxxp://192[.]109[.]200[.]63/regevent |
Amatera |
| URL | hxxp://ursosmart[.]lol/api/dps hxxp://ursosmart[.]lol/api/ps hxxp://ursosmart[.]lol/api/decrypter |
RapidStealer |
| URL | hxxps://documentos[.]microsoft-waresystems[.]com/Plugin_Planilha[.]vbs hxxps://185[.]196[.]10[.]230/Planilha_Faturamento[.]xlsx[.]lnk hxxps://185[.]196[.]10[.]230/Plugin_Planilha[.]vbs hxxps://documentos[.]microsoft-waresystems[.]com/Planilha_Faturamento[.]xlsx[.]lnk |
PureRAT |
| URL | hxxp://130[.]12[.]180[.]43/files/8408827406/AHUfa84[.]exe | AsyncRAT |
| URL | hxxp://34[.]58[.]195[.]70/payload[.]ps1 hxxp://34[.]58[.]195[.]70/diagnostico[.]exe hxxp://34[.]58[.]195[.]70/clinica_update[.]exe |
Metasploit |
| URL | hxxps://personbro[.]com/YjQ1YmQ0ZGE5ODIz/ hxxps://p4ersonbro[.]com/YjQ1YmQ0ZGE5ODIz/ hxxps://pers6onbro[.]com/YjQ1YmQ0ZGE5ODIz/ hxxps://p1ersonbro[.]com/YjQ1YmQ0ZGE5ODIz/ hxxps://pers4onbro[.]com/YjQ1YmQ0ZGE5ODIz/ hxxps://p7ersonbro[.]com/YjQ1YmQ0ZGE5ODIz/ hxxps://perso3nbro[.]com/YjQ1YmQ0ZGE5ODIz/ hxxps://pe1rsonbro[.]com/YjQ1YmQ0ZGE5ODIz/ hxxps://per2sonbro[.]com/YjQ1YmQ0ZGE5ODIz/ |
Coper |
| URL | hxxp://ys8758[.]com/%EA%B3%B5%EB%8F%99%20%EC%9E%90%EB%A3%8C%EC%8B%A4/remote2[.]exe | Brute Ratel C4 |
| URL | hxxp://162[.]212[.]153[.]138:8080/sliver-client_linux-amd64 | Sliver |
| URL | hxxp://130[.]12[.]180[.]43/files/7471363698/g2zctI3[.]exe hxxp://130[.]12[.]180[.]43/files/7471363698/ldyZQxj[.]exe |
Coinminer |
| URL | hxxps://hostingcdn[.]click/of[.]zip | ACR Stealer |
| URL | hxxps://github[.]com/elitehint/Fluxus-Roblox-Executor/raw/refs/heads/main/Fluxus%20V7[.]exe | SantaStealer |
| URL | hxxps://visualls[.]trueblog[.]sbs/Visual%20Studio[.]zip | Amadey |
| URL | hxxps://deceptqower[.]onfinality[.]pro/adb8a56294dadf33644cb54a090cb9f6/folgk[.]bvqd | Rhadamanthys |
| URL | hxxp://130[.]12[.]180[.]43/files/7782139129/UQs5KQA[.]exe | SmokeLoader |
