Remus
5New IOCs · 24h
61New IOCs · 7 days
88Indicators tracked
1Independent feeds
2026-10-12 06:23Last activity
New indicators per day
2026-09-29 to 2026-10-12, by first report.
- URL59
- IP21
- Domain8
- C284
- Malware4
Where its infrastructure is hosted
Latest indicators
Filter the live feed →| First seen | Type | Indicator | Role | Where |
|---|---|---|---|---|
| 2026-10-12 06:23 | URL | hxxp://spiohop[.]shop:9932/imports | Botnet C2 | — |
| 2026-10-12 06:23 | URL | hxxp://booohop[.]shop:5627/addresses | Botnet C2 | — |
| 2026-10-11 19:56 | URL | hxxp://unseanb[.]surf:9059 | Botnet C2 | — |
| 2026-10-11 12:53 | URL | hxxp://crownsquareproductions[.]com:4219 | Botnet C2 | — |
| 2026-10-11 12:48 | URL | hxxp://tyxa[.]today:4894 | Botnet C2 | — |
| 2026-10-11 07:02 | IP | 64.91.238[.]87:2905 | Botnet C2 | — |
| 2026-10-11 07:02 | IP | 187.77.136[.]206:6902 | Botnet C2 | — |
| 2026-10-11 06:31 | URL | hxxp://saganlive[.]com:5747 | Botnet C2 | — |
| 2026-10-11 06:00 | URL | hxxp://arqtsop[.]shop:9932/reviews | Botnet C2 | — |
| 2026-10-10 22:35 | URL | hxxp://hkealop[.]shop:9932/sessions | Botnet C2 | — |
| 2026-10-10 14:22 | URL | hxxp://homecor[.]click:6527/documents | Botnet C2 | — |
| 2026-10-10 14:22 | URL | hxxp://fgashub[.]shop:9932/addresses | Botnet C2 | — |
| 2026-10-10 14:22 | URL | hxxp://phetsre[.]shop:3452/teams | Botnet C2 | — |
| 2026-10-10 10:38 | URL | hxxp://rvweldedmesh[.]com:4219 | Botnet C2 | — |
| 2026-10-10 07:15 | URL | hxxp://straely[.]biz:8531/imports | Botnet C2 | — |
| 2026-10-09 22:06 | URL | hxxp://derelb[.]shop:3781 | Botnet C2 | — |
| 2026-10-09 18:17 | URL | hxxp://arqtsop[.]shop:9932/documents | Botnet C2 | — |
| 2026-10-09 18:17 | URL | hxxp://trwehop[.]shop:5627/comments | Botnet C2 | — |
| 2026-10-09 13:05 | IP | 104.248.144[.]172:6738 | Botnet C2 | — |
| 2026-10-09 11:12 | URL | hxxp://homecor[.]click:6527/imports | Botnet C2 | — |
| 2026-10-09 04:31 | URL | hxxp://caxools[.]click:7728/reports | Botnet C2 | — |
| 2026-10-09 04:31 | URL | hxxp://gerzone[.]click:4262/settings | Botnet C2 | — |
| 2026-10-09 04:31 | URL | hxxp://synerfy[.]biz:6627/messages | Botnet C2 | — |
| 2026-10-09 04:31 | URL | hxxp://assetvs[.]biz:4529/videos | Botnet C2 | — |
| 2026-10-08 15:24 | URL | hxxp://caxools[.]click:7728/collections | Botnet C2 | — |
| 2026-10-08 15:24 | URL | hxxp://bravplo[.]click:7713/contacts | Botnet C2 | — |
| 2026-10-08 15:24 | URL | hxxp://flreaow[.]click:6527/projects | Botnet C2 | — |
| 2026-10-08 15:24 | URL | hxxp://fezm[.]website:9048/reviews | Botnet C2 | — |
| 2026-10-08 12:18 | URL | hxxp://fezm[.]website:9048/reports | Botnet C2 | — |
| 2026-10-08 08:52 | Domain | zeodth[.]click | Botnet C2 | — |
| 2026-10-08 05:34 | IP | 152.42.197[.]255:8632 | Botnet C2 | — |
| 2026-10-08 05:33 | URL | hxxp://hzeodth[.]click/ | Botnet C2 | — |
| 2026-10-08 03:37 | URL | hxxp://neortal[.]click:8321/exports | Botnet C2 | — |
| 2026-10-07 16:32 | URL | hxxp://apedlow[.]help:9932/invoices | Botnet C2 | — |
| 2026-10-07 16:32 | URL | hxxp://cryonex[.]sbs:5621/images | Botnet C2 | — |
| 2026-10-07 16:32 | URL | hxxp://cfcher[.]biz:8531/orders | Botnet C2 | — |
| 2026-10-07 16:22 | URL | hxxp://glolsbs[.]top:5621/workspaces | Botnet C2 | — |
| 2026-10-07 16:17 | URL | hxxp://nexssbs[.]sbs:9932/files | Botnet C2 | — |
| 2026-10-07 16:17 | URL | hxxp://glolsbs[.]top:5621/teams | Botnet C2 | — |
| 2026-10-07 16:06 | URL | hxxp://cryonex[.]sbs:5621/teams | Botnet C2 | — |
| 2026-10-07 16:06 | URL | hxxp://cfcher[.]biz:8531/documents | Botnet C2 | — |
| 2026-10-07 16:06 | URL | hxxp://apedlow[.]help:9932/messages | Botnet C2 | — |
| 2026-10-07 14:27 | IP | 72.61.140[.]138:6738 | Botnet C2 | — |
| 2026-10-07 11:56 | Domain | apexfd[.]click | Botnet C2 | — |
| 2026-10-07 11:56 | Domain | cryonex[.]sbs | Botnet C2 | — |
| 2026-10-07 11:56 | Domain | cfcher[.]biz | Botnet C2 | — |
| 2026-10-07 10:38 | IP | 15.204.253[.]8:5621 | Botnet C2 | — |
| 2026-10-07 04:37 | IP | 45.55.202[.]73:9932 | Botnet C2 | — |
| 2026-10-07 04:37 | IP | 87.232.123[.]60:4326 | Botnet C2 | — |
| 2026-10-06 07:57 | URL | hxxp://trencts[.]shop:8592/folders | Botnet C2 | — |
| 2026-10-06 07:46 | URL | hxxp://visnary[.]my:5621/tags | Botnet C2 | — |
| 2026-10-06 07:41 | URL | hxxp://synerfy[.]biz:6627/addresses | Botnet C2 | — |
| 2026-10-06 07:41 | URL | hxxp://assetvs[.]biz:4529/customers | Botnet C2 | — |
| 2026-10-06 07:31 | URL | hxxp://futlink[.]click:4326/documents | Botnet C2 | — |
| 2026-10-06 07:00 | URL | hxxp://sxdment[.]click:5003/comments | Botnet C2 | — |
| 2026-10-06 07:00 | URL | hxxp://gerzone[.]click:4262/webhooks | Botnet C2 | — |
| 2026-10-06 06:55 | URL | hxxp://sxdment[.]click:5003/permissions | Botnet C2 | — |
| 2026-10-06 06:39 | URL | hxxp://futlink[.]click:4326/profiles | Botnet C2 | — |
| 2026-10-06 05:27 | IP | 186.194.50[.]58:5930 | Botnet C2 | — |
| 2026-10-06 04:53 | URL | hxxp://sdatery[.]shop:5003/workspaces | Botnet C2 | — |
| 2026-10-06 04:53 | URL | hxxp://coxmics[.]shop:4262/invoices | Botnet C2 | — |
| 2026-10-05 06:15 | IP | 64.227.100[.]23:2319 | Botnet C2 | — |
| 2026-10-03 17:28 | IP | 76.13.146[.]81:5203 | Botnet C2 | — |
| 2026-09-30 19:00 | IP | 135.148.70[.]131:9217 | Botnet C2 | — |
| 2026-09-30 12:21 | IP | 72.61.149[.]25:9837 | Botnet C2 | — |
| 2026-09-30 05:49 | IP | 159.89.166[.]50:8531 | Botnet C2 | — |
| 2026-09-30 05:49 | IP | 187.127.178[.]97:9832 | Botnet C2 | — |
| 2026-09-29 06:28 | IP | 167.99.67[.]141:6627 | Botnet C2 | — |
| 2026-09-29 06:28 | IP | 23.254.202[.]107:7528 | Botnet C2 | — |
| 2026-09-26 15:11 | IP | 143.244.190[.]5:5621 | Botnet C2 | — |
| 2026-09-11 07:33 | IP | 147.182.203[.]222:9932 | Botnet C2 | — |
| 2026-09-06 06:19 | IP | 51.195.113[.]99:3267 | Botnet C2 | — |
| 2026-09-04 06:42 | IP | 137.184.108[.]14:6929 | Botnet C2 | — |
| 2026-08-30 15:55 | URL | hxxp://zonxh[.]shop:7728/reports | Botnet C2 | — |
| 2026-08-23 00:40 | URL | hxxp://zonxh[.]shop:7728/orders | Botnet C2 | — |
| 2026-08-17 22:15 | URL | hxxp://kupzovo[.]shop:7567/accounts | Botnet C2 | — |
| 2026-08-15 08:45 | URL | hxxp://bravplo[.]click:7713/settings | Botnet C2 | — |
| 2026-08-10 10:00 | URL | hxxp://tokjoza[.]shop:5200/attachments | Botnet C2 | — |
| 2026-08-10 10:00 | URL | hxxp://shkpiva[.]shop:5627/tokens | Botnet C2 | — |
| 2026-08-10 10:00 | URL | hxxp://beljaro[.]shop:2536/accounts | Botnet C2 | — |
| 2026-07-04 04:21 | URL | hxxp://tolail[.]xyz:7538 | Botnet C2 | — |
| 2026-06-21 22:58 | Domain | www[.]rzeczoznawcaklama[.]pl | Payload delivery | — |
| 2026-06-21 22:58 | Domain | vitimadetransito[.]com[.]br | Payload delivery | — |
| 2026-06-21 22:58 | Domain | newalphaco[.]com | Payload delivery | — |
| 2026-06-21 22:58 | Domain | b2ccom[.]com[.]br | Payload delivery | — |
| 2026-06-10 06:20 | URL | hxxp://zsigmu[.]shop:7673 | Botnet C2 | — |
| 2026-06-10 06:20 | URL | hxxp://thequarterlymethod[.]com:6584 | Botnet C2 | — |
| 2026-06-10 06:19 | URL | hxxp://contentremixrr[.]com:6584 | Botnet C2 | — |
Defanged for safety. URL query strings removed.