不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様40社 -
2026/10/05
※2026/10/05 更新
マルウェア感染させると考えられるURLを検知（2026/10/05）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://glolsbs[.]top:5621/collections hxxp://nexssbs[.]sbs:9932/contacts hxxp://flozwave[.]click:6572/webhooks hxxp://glolsbs[.]top:5621/payments hxxp://nexssbs[.]sbs:9932/messages hxxp://glotech[.]art:9932/imports hxxp://smatart[.]my:8531/webhooks hxxp://glolsbs[.]top:5621/notifications hxxp://nexssbs[.]sbs:9932/exports hxxp://homecor[.]click:6527/payments hxxp://tfoyses[.]shop:3452/addresses hxxp://kipthen[.]shop:9932/images hxxp://gerzone[.]click:4262/images hxxp://sxdment[.]click:5003/images hxxp://caxools[.]click:7728/notifications hxxp://sxdment[.]click:5003/notifications hxxp://gerzone[.]click:4262/exports hxxp://glolsbs[.]top:5621/settings hxxp://nexssbs[.]sbs:9932/products hxxp://gerzone[.]click:4262/sessions hxxp://sxdment[.]click:5003/invoices hxxp://coxmics[.]shop:4262/users hxxp://dctshop[.]shop:7728/comments hxxp://gerzone[.]click:4262/subscriptions hxxp://sxdment[.]click:5003/reports hxxp://caxools[.]click:7728/transactions hxxp://caxools[.]click:7728/imports hxxp://gerzone[.]click:4262/folders hxxp://glolsbs[.]top:5621/tokens hxxp://sparlink[.]click:7528/addresses hxxp://visnary[.]my:5621/reports hxxp://prility[.]top:9932/contacts hxxp://straely[.]biz:8531/users hxxp://glolsbs[.]top:5621/addresses hxxp://nexssbs[.]sbs:9932/videos hxxp://staphub[.]art:8531/tags hxxp://visnary[.]my:5621/documents hxxp://homecor[.]click:6527/customers hxxp://staphub[.]art:8531/articles hxxp://visnary[.]my:5621/contacts hxxp://gerzone[.]click:4262/transactions hxxp://sxdment[.]click:5003/accounts hxxp://petcarv[.]click:8239/articles hxxp://gerzone[.]click:4262/addresses hxxp://sxdment[.]click:5003/imports hxxp://trencts[.]shop:8592/posts hxxp://futlink[.]click:4326/attachments hxxp://futlink[.]click:4326/tasks hxxp://futlink[.]click:4326/addresses hxxp://futlink[.]click:4326/notifications hxxp://futlink[.]click:4326/articles hxxp://gerzone[.]click:4262/permissions hxxp://sxdment[.]click:5003/profiles hxxp://gerzone[.]click:4262/tasks hxxp://sxdment[.]click:5003/teams hxxp://visnary[.]my:5621/payments hxxp://prility[.]top:9932/accounts hxxp://neortal[.]click:8321/reviews hxxp://petcarv[.]click:8239/workspaces hxxp://gerzone[.]click:4262/tokens hxxp://sxdment[.]click:5003/articles hxxp://gerzone[.]click:4262/collections hxxp://sxdment[.]click:5003/subscriptions hxxp://teechop[.]shop:8213/profiles hxxp://teculse[.]click:9210/collections hxxp://gerzone[.]click:4262/workspaces hxxp://sxdment[.]click:5003/reviews hxxp://tfoyses[.]shop:3452/folders hxxp://homecor[.]click:6527/exports hxxp://glotech[.]art:9922/webhooks hxxp://equigfy[.]biz:9932/exports hxxp://sxdment[.]click:5003/tokens hxxp://coxmics[.]shop:4262/accounts hxxp://sdatery[.]shop:5003/tokens hxxp://glolsbs[.]top:5621/reports hxxp://nexssbs[.]sbs:9932/permissions hxxp://straely[.]biz:8531/attachments hxxp://nexssbs[.]sbs:9932/accounts hxxp://glolsbs[.]top:5621/documents |
Remus |
| URL | hxxps://b8t[.]shop/bps hxxps://static-js[.]com/zens hxxps://static-js[.]com/cg hxxps://static-js[.]com/jmj hxxps://static-js[.]com/bps |
MageCart |
| URL | hxxp://103[.]229[.]53[.]84:8443/update[.]ps1 hxxp://45[.]131[.]215[.]56/8031e818c7a46?force=1 hxxps://gixxipi9823[.]life/t[.]js hxxps://cabskaiyn-crane[.]life/collect hxxps://cabskaiyn-crane[.]life/t[.]js hxxps://stepbysteppi9[.]life/collect hxxps://stepbysteppi9[.]life/ext-b[.]8203a4e3ce1a[.]js hxxps://stepbysteppi9[.]life/t[.]js hxxps://krestmoais-reed[.]life/collect hxxps://krestmoais-reed[.]life/ext-b[.]b96ad0785c08[.]js hxxps://krestmoais-reed[.]life/t[.]4b1009ff6c3f[.]js hxxps://krestmoais-reed[.]life/t[.]js hxxps://ashen-trace-zephyr-draeix[.]life/collect hxxps://ashen-trace-zephyr-draeix[.]life/ext-b[.]b96ad0785c08[.]js hxxps://ashen-trace-zephyr-draeix[.]life/t[.]4b1009ff6c3f[.]js hxxps://ashen-trace-zephyr-draeix[.]life/t[.]js hxxps://mesa-braior-k3w3b[.]life/collect hxxps://mesa-braior-k3w3b[.]life/ext[.]fb58e796b418[.]js hxxps://mesa-braior-k3w3b[.]life/t[.]4b1009ff6c3f[.]js hxxps://mesa-braior-k3w3b[.]life/t[.]js hxxps://sarp08[.]no/vcapcha[.]ps1 hxxp://93[.]152[.]223[.]30:5000/uploads/admin/stage2[.]ps1 hxxp://103[.]229[.]53[.]84:8443/r[.]ps1 hxxps://abelmomaroc[.]com/wp-content/plugins/advanced-maximum-bar/assets/js/captcha-loader[.]js hxxp://sdoffice[.]com[.]br/wp-content/plugins/verify/proxy[.]php hxxps://checkmybtrobot[.]cc/j/traffic?r=c1cc hxxps://checkmybtrobot[.]cc/ps/traffic?r=c1cc |
IClickFix |
| URL | hxxp://107[.]172[.]235[.]223/60/wegivenbestthings[.]js hxxp://107[.]172[.]235[.]223/60/img_205615[.]png hxxp://107[.]172[.]235[.]223/60/hhn[.]hta hxxp://198[.]12[.]126[.]187/35/goodnewsthings[.]jS hxxp://198[.]12[.]126[.]187/35/JJN[.]htA |
Remcos |
| URL | hxxp://195[.]178[.]110[.]48:8099/xmrig-x64[.]tar[.]gz | XMRig |
| URL | hxxps://tmpfiles[.]org/dl/1790921964[.]cc1fb986876287ec/w6Aney6JrUq8/nanocore[.]js hxxps://tmpfiles[.]org/dl/1790921720[.]87bd996efc2584f6/wGAdep6P9UOc/nanocore[.]exe hxxps://github[.]com/thuhangn562727-del/maqueo/raw/refs/heads/main/mko1[.]exe hxxps://github[.]com/thuhangn562727-del/maqueo/raw/refs/heads/main/mko2[.]exe hxxps://github[.]com/thuhangn562727-del/maqueo/raw/refs/heads/main/tgteru[.]exe hxxps://github[.]com/thuhangn562727-del/maqueo/raw/refs/heads/main/tgryan[.]exe hxxps://github[.]com/thuhangn562727-del/maqueo/raw/refs/heads/main/svchost[.]exe hxxps://github[.]com/thuhangn562727-del/maqueo/raw/refs/heads/main/Google[.]exe hxxps://github[.]com/thuhangn562727-del/maqueo/raw/refs/heads/main/saitama[.]exe |
AsyncRAT |
| URL | hxxp://165[.]22[.]18[.]19:8889/gh0st148 hxxp://195[.]178[.]110[.]48:8099/beat_up |
Cobalt Strike |
| URL | hxxp://124[.]29[.]221[.]143:49889/Mozi[.]m hxxp://124[.]29[.]214[.]148:47630/Mozi[.]a hxxp://103[.]26[.]83[.]105:59796/Mozi[.]m hxxp://105[.]184[.]94[.]10:40511/Mozi[.]a hxxp://144[.]48[.]135[.]109:44529/Mozi[.]m hxxp://124[.]29[.]247[.]79:54299/Mozi[.]7 hxxp://175[.]107[.]217[.]82:48392/Mozi[.]m hxxp://223[.]123[.]73[.]247:34161/Mozi[.]m hxxp://78[.]38[.]120[.]12:35789/Mozi[.]7 hxxp://103[.]244[.]172[.]129:40121/Mozi[.]m hxxp://223[.]123[.]43[.]34:57061/Mozi[.]m hxxp://43[.]230[.]94[.]184:58357/Mozi[.]m hxxp://124[.]29[.]194[.]209:55496/Mozi[.]m hxxp://203[.]101[.]177[.]94:60872/Mozi[.]7 hxxp://91[.]127[.]103[.]137:58536/Mozi[.]m hxxp://203[.]101[.]186[.]131:52469/Mozi[.]m hxxp://43[.]230[.]94[.]183:56170/Mozi[.]7 hxxp://112[.]248[.]62[.]71:46743/Mozi[.]m hxxp://101[.]108[.]15[.]158:50943/Mozi[.]a hxxp://175[.]107[.]2[.]52:53322/Mozi[.]m hxxp://110[.]38[.]254[.]22:57054/Mozi[.]m hxxp://180[.]245[.]56[.]161:52486/Mozi[.]a hxxp://137[.]59[.]218[.]64:43067/Mozi[.]7 hxxp://223[.]123[.]43[.]134:40628/Mozi[.]m hxxp://223[.]123[.]124[.]111:46750/Mozi[.]m hxxp://137[.]59[.]230[.]145:42414/Mozi[.]m hxxp://112[.]195[.]117[.]249:45477/Mozi[.]a |
Mozi |
| URL | hxxp://45[.]125[.]32[.]79:6699/?h=45[.]125[.]32[.]79&p=6699&t=tcp&a=w64&stage=true hxxp://139[.]99[.]135[.]67:19999/?h=139[.]99[.]135[.]67&p=19999&t=ws&a=w64&stage=true hxxp://45[.]125[.]32[.]79:6699/?h=45[.]125[.]32[.]79&p=6699&t=ws&a=w32&stage=true hxxp://45[.]125[.]32[.]79:6699/?h=45[.]125[.]32[.]79&p=6699&t=ws&a=w64&stage=true hxxp://45[.]125[.]32[.]79:6699/?h=45[.]125[.]32[.]79&p=6699&t=tcp&a=w32&stage=true hxxp://192[.]255[.]236[.]156:8084/?h=192[.]255[.]236[.]156&p=8084&t=tcp&a=w64&stage=true hxxp://8[.]218[.]2[.]176:8084/?h=8[.]218[.]2[.]176&p=8084&t=tcp&a=w64&stage=true hxxp://8[.]218[.]2[.]176:8084/?h=8[.]218[.]2[.]176&p=8084&t=tcp&a=w32&stage=true hxxp://149[.]88[.]73[.]99:2222/?h=149[.]88[.]73[.]99&p=2222&t=ws&a=w32&stage=true hxxp://45[.]192[.]105[.]32:18084/?h=45[.]192[.]105[.]32&p=18084&t=tcp&a=w64&stage=true |
Vshell |
| URL | hxxp://178[.]132[.]198[.]200/payload_v12[.]sh | Echobot |
| URL | hxxps://www[.]rgrd90[.]cc/set[.]msi | RMS |
| URL | hxxp://31[.]56[.]209[.]73:65161/s/kal64 hxxp://31[.]56[.]209[.]73:65161/s/kswpad |
BillGates |
| URL | hxxp://176[.]65[.]139[.]160/xmrig-x86 hxxp://176[.]65[.]139[.]160/xmrig-x64 hxxp://176[.]65[.]139[.]160/xmrig-aarch64 hxxp://176[.]65[.]139[.]160/xmrig-arm hxxp://156[.]200[.]99[.]139/av[.]scr hxxp://111[.]235[.]143[.]155:8080/info[.]zip hxxp://111[.]235[.]143[.]155:8080/Photo[.]scr hxxp://maxxlavalink[.]cyou/mipsel hxxp://maxxlavalink[.]cyou/mips |
Coinminer |
| URL | hxxp://117[.]240[.]155[.]245:30250/sshd hxxp://118[.]69[.]157[.]212:9112//sshd |
SSHDoor |
| URL | hxxp://207[.]244[.]234[.]243:8000/xmrig | Mirai |
| URL | hxxp://178[.]16[.]54[.]109/suckdick[.]exe | Phorpiex |
| URL | hxxp://31[.]220[.]3[.]140/ri/la[.]bot[.]sh4 hxxp://176[.]65[.]139[.]140/bins/exodus[.]sh hxxp://104[.]168[.]4[.]206/dissx86 hxxp://104[.]168[.]4[.]206/dissarm4 hxxp://104[.]168[.]4[.]206/dissmpsl hxxp://5[.]175[.]222[.]236/bins/xnxnxnxnxnxnxnxni386xnxn hxxp://104[.]168[.]4[.]206/adissarm5 hxxp://104[.]168[.]4[.]206/dissmips hxxp://104[.]168[.]4[.]206/dissarm6 hxxp://104[.]168[.]4[.]206/bins[.]sh |
Bashlite |
| URL | hxxps://github[.]com/thuhangn562727-del/maqueo/raw/refs/heads/main/gaylo[.]exe | Quasar RAT |
| URL | hxxps://kavacanada[.]ca/catalog/model/cummersMG[.]exe | Koi Loader |
| URL | hxxps://allowcsxan2[.]site/js/all[.]min[.]js hxxps://chekcms432[.]cc/js/all[.]min[.]js hxxps://updateocean[.]com/get_script |
ClearFake |
| URL | hxxps://ghostloader[.]xyz//loader/build_87390/encrypted/stage2[.]exe | win.ghostengine |
| URL | hxxps://217[.]60[.]102[.]5/x86_64 hxxps://217[.]60[.]102[.]5/aarch64 hxxps://217[.]60[.]102[.]5/i686 hxxps://217[.]60[.]102[.]5/arm7 |
Prometei |
| URL | hxxps://217[.]60[.]102[.]5/riscv | RedTail |
| URL | hxxp://sibada8888[.]top/content/uploadfile/202412/0fff1734281601[.]exe | XRed |
| URL | hxxps://upload[.]filehost[.]lol/KnGq1Rzde2ZwMW5RJT5q[.]png hxxps://upload[.]filehost[.]lol/qP7aC?9Z=L |
Rhadamanthys |
| URL | hxxp://23[.]94[.]145[.]112/svvhost[.]exe | DarkTortilla |
| URL | hxxps://libraryadvances[.]com/noj hxxps://libraryadvances[.]com/os |
FAKEUPDATES |
