不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2026/06/24
※2026/06/24 更新
マルウェア感染させると考えられるURLを検知（2026/06/24）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://foorar9u[.]megapariwin[.]poker/?ublib=c53a6582-4b18-4206-ae2b-8a45c190560f hxxps://yw1tz6yc[.]englishekhtesasi[.]xyz/?ublib=521ee65b-b9c7-4244-939c-cefd892636e3 hxxps://m3f7xwi4[.]ensandareslam[.]xyz/?ublib=5a7e45b0-bbc7-4b87-a60f-d043508040bd hxxps://jxsf8qrc[.]edareumumi[.]xyz/?ublib=ec8085ba-a62a-497b-9c3e-ee8eb13146b3 hxxps://ordiljgt[.]entegaljerm[.]xyz/?ublib=2ec2b287-b544-43d5-bb1c-5546e07d4fe0 hxxps://az6trzrx[.]one1xbet[.]vip/?ublib=75ae8a0c-7e51-4f2a-8c55-a6490d9b08a9 hxxps://qze3e7uq[.]megaparivip[.]net/?ublib=e9aae35f-7518-4b0c-b360-50a20b91c243 hxxps://2b4zfudu[.]ekhtelalat[.]xyz/?ublib=c3a07065-8e54-4976-92dd-0d1f14b3e07d hxxps://l2ekym1s[.]megaparivip[.]vip/?ublib=3e039423-8997-458a-8b17-e7f46a695833 hxxps://dlsak5pv[.]megapariwin[.]bet/?ublib=1cad5ed2-bbff-4ad1-9f7d-ea9082c2d041 hxxps://2k7d5hmd[.]one1xbet[.]win/?ublib=452f58ff-1213-4de7-a9f7-206d03e36b66 hxxps://haqoakt0[.]elmolnafs[.]xyz/?ublib=76a085a2-bb73-40f7-ab15-c6477d426c3b hxxps://ygl9tk3l[.]ekhtelalattabrizi[.]xyz/?ublib=adb1975c-0f72-4c15-bfe6-bdd05374dfc9 hxxps://mx8cw0rw[.]engelabeslami[.]xyz/?ublib=ec391420-b068-4315-a1de-5093fb9483b3 hxxps://s7w5r3s2[.]onebet1x[.]com/?ublib=3853f05d-c7f1-475b-a0e8-d8c72a0d9441 hxxps://69xb4m1d[.]betmajic[.]cc/?ublib=d8b4f87c-aa48-4fdd-a215-ea08f68ed6fe hxxps://8ra83hil[.]blackjackonlineplay83[.]com/?ublib=55ce4ecc-431f-4b5c-9237-45709215d541 hxxps://bpyos3va[.]blackjack-x[.]com/?ublib=58592673-e4de-4377-9c8b-23149cf22a4a hxxps://p0d2virz[.]blackjacktipsnnt[.]com/?ublib=b7adadd3-bf63-4a27-a9d5-e1294e8d8cc7 hxxps://e1fi2yi1[.]vip1x[.]bet/?ublib=370112d6-38db-4738-a39a-6e6f52d505db hxxps://vzhtsv4n[.]1x303[.]casino/?ublib=e4eb4459-9f9d-4323-86ba-acd71796216f |
ClearFake |
| URL | hxxps://216[.]173[.]65[.]250/dispatch_service/v2/test | KV |
| URL | hxxp://223[.]123[.]42[.]237:49820/Mozi[.]m hxxp://103[.]98[.]37[.]183:37776/Mozi[.]m hxxp://182[.]116[.]120[.]29:53323/Mozi[.]m hxxp://125[.]27[.]11[.]223:36704/Mozi[.]m hxxp://72[.]255[.]32[.]94:51378/Mozi[.]m hxxp://202[.]70[.]139[.]77:44049/Mozi[.]m hxxp://101[.]53[.]224[.]211:42723/Mozi[.]m |
Mozi |
| URL | hxxps://bartach[.]xyz/file[.]js hxxps://bartach[.]xyz/api/v1/session hxxps://bartach[.]xyz/api/v1/verify hxxps://bartach[.]xyz/api/v1/status hxxps://gileert[.]xyz/file[.]js hxxps://gileert[.]xyz/api/v1/session hxxps://gileert[.]xyz/api/v1/verify hxxps://gileert[.]xyz/api/v1/status hxxps://secondv[.]lol/o |
KongTuke |
| URL | hxxp://196[.]251[.]107[.]104/23x06x2026_x64[.]exe | Stealc |
| URL | hxxps://yettyagency[.]tz/Client4[.]exe | PureLogs Stealer |
| URL | hxxps://mail[.]avicennaalliedhealthinstitute[.]org/ojstub[.]ps1 | Stealerium |
| URL | hxxps://mail[.]avicennaalliedhealthinstitute[.]org/stubmy[.]ps1 | Formbook |
| URL | hxxps://tmpfiles[.]org/dl/wuwSJfIJjQUS/svchost[.]exe | PureRAT |
| URL | hxxps://techosazteca[.]com/wp-admin/img_130809[.]png hxxp://kzaa[.]co[.]za/1[.]jpg |
Remcos |
| URL | hxxps://178[.]16[.]52[.]80/hold[.]bat hxxp://178[.]16[.]52[.]80/hold[.]bat |
Koadic |
| URL | hxxps://api[.]telegram[.]org/bot8863119254:AAH253pnN63l3kHxRxN-9CdTBo712ifHgpM/sendMessage?chat_id=8153569978 | MASS Logger |
