不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様5社 -
2025/11/19
※2025/11/19 更新
マルウェア感染させると考えられるURLを検知（2025/11/19）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://195[.]20[.]19[.]212/p[.]txt | XOR DDoS |
| URL | hxxps://gleam[.]p0lys5pear[.]ru/hbmf2nq3 hxxps://gleam[.]p0lys5pear[.]ru/4lr6ihm7 hxxps://bach[.]f1anerchan[.]ru/utp777s1 hxxps://wind[.]f1anerchan[.]ru/mynzu5db hxxps://mond[.]neighb0rrol1[.]ru/aeaglc7c hxxps://mond[.]neighb0rrol1[.]ru/nsi27up6 hxxps://ufer[.]neighb0rrol1[.]ru/qvpnuq1y hxxps://ufer[.]neighb0rrol1[.]ru/l2425wxg hxxps://weiss[.]neighb0rrol1[.]ru/jac0zhrh hxxps://dorn[.]neighb0rrol1[.]ru/z5pl9z85 hxxps://wolfe[.]neighb0rrol1[.]ru/d8dawja8 hxxps://hain[.]f1anerchan[.]ru/cyizhbqc hxxps://krone[.]chankexpe1[.]ru/j2m72gn4 hxxps://krone[.]chankexpe1[.]ru/0g7bfsfa hxxps://moos[.]chankexpe1[.]ru/klsc27cw hxxps://kamm[.]gulag1emur[.]ru/d9y3z1mn hxxps://glow[.]gulag1emur[.]ru/huat13tp hxxps://eiche[.]harmfu1tw0[.]ru/xbz86355 hxxps://glanz[.]harmfu1tw0[.]ru/apg556vo hxxps://sturm[.]chankexpe1[.]ru/seau2o63 hxxps://stern[.]f0re5tline[.]ru/3g4lf9g7 hxxps://geist[.]rap1d5t0ne[.]ru/olmj58oh hxxps://moos[.]rap1d5t0ne[.]ru/649v4c7p hxxps://klee[.]5ilverm0on[.]ru/1av7727x hxxps://pfad[.]br1ght5tar[.]ru/7tjpyk44 hxxps://glade[.]f0re5tline[.]ru/pmmnf0qu hxxps://tau[.]f0re5tline[.]ru/i5lza4mv hxxps://wolke[.]b1ue5pr1lng[.]ru/a1lqrcsl hxxps://rune[.]b1ue5pr1lng[.]ru/cs7wnp5z hxxps://wald[.]wlnd5hore[.]ru/e8p8dmur hxxps://tal[.]c1oudmap[.]ru/tz21xwj4 hxxps://krone[.]st0nefall[.]ru/uhtasvox hxxps://moor[.]st0nefall[.]ru/k5lbryif hxxps://kamm[.]st0nefall[.]ru/xiucu12r hxxps://eiche[.]starfie1d[.]ru/jxzqwqdq hxxps://bach[.]c1oudmap[.]ru/0r7l3d1r hxxps://falke[.]crystalrun[.]ru/7ny77d5q hxxps://pfad[.]crystalrun[.]ru/rbfp02ce hxxps://tau[.]st0nefall[.]ru/yyp17c5t hxxps://harz[.]br1ghtf0x[.]ru/bbe79zx6 hxxps://harz[.]br1ghtf0x[.]ru/5z09pzkg hxxps://weiss[.]crystalrun[.]ru/s1mn24iw hxxps://glut[.]l1ghtseed[.]ru/ojjgt8vt hxxps://glut[.]l1ghtseed[.]ru/g66lixjb hxxps://korn[.]w1ndmark[.]ru/wfkn6qz1 hxxps://licht[.]s0ftwind[.]ru/i4wtm9ru hxxps://ufer[.]s0ftwind[.]ru/pqlf2el4 hxxps://birhc[.]c1earpeak[.]ru/jpb4zehb hxxps://birhc[.]c1earpeak[.]ru/1ij3bv86 hxxps://glowe[.]c1earpeak[.]ru/sz89qc0z hxxps://wolkr[.]c1earpeak[.]ru/9li1wycx hxxps://tau[.]l1ghtseed[.]ru/cbqstnbq hxxps://stern[.]l1ghtseed[.]ru/mk6o9bbq hxxps://winde[.]moonf1eld[.]ru/1gql0pij hxxps://brige[.]moonf1eld[.]ru/bhmqq35q hxxps://mooss[.]moonf1eld[.]ru/xzljk544 hxxps://mooss[.]moonf1eld[.]ru/033kpd8q hxxps://kleea[.]st0nedrift[.]ru/iy7ay8ok hxxps://sterm[.]st0nedrift[.]ru/yw7fztcp hxxps://sterm[.]st0nedrift[.]ru/eksho9rd hxxps://uefer[.]c1earpeak[.]ru/4f6xrnia hxxps://mossy[.]0akstream[.]ru/7wbywdyc hxxps://rivul[.]0akstream[.]ru/9ln20g3p hxxps://licth[.]crysta1shore[.]ru/ocijsnpm hxxps://licth[.]crysta1shore[.]ru/48ec53mt hxxps://quarz[.]crysta1shore[.]ru/2bc030i6 hxxps://tall[.]moonf1eld[.]ru/3fazdmom hxxps://wolke[.]deepv0yage[.]ru/ezupzu8f hxxps://trakk[.]deepv0yage[.]ru/uehfwatv hxxps://gleem[.]deepv0yage[.]ru/qeafd7ql hxxps://gleem[.]deepv0yage[.]ru/0blvrabi hxxps://harbr[.]deepv0yage[.]ru/lqn7j2by hxxps://weald[.]0akstream[.]ru/l9vx98e2 hxxps://weald[.]0akstream[.]ru/ynfjca3f hxxps://bruke[.]0akstream[.]ru/6ffyqwqz hxxps://bruke[.]0akstream[.]ru/qn37wwg0 hxxps://wylde[.]s0ftvale[.]ru/b7r7xt7o hxxps://vally[.]s0ftvale[.]ru/4xhvl6sc hxxps://vally[.]s0ftvale[.]ru/alkzwy7i hxxps://gusty[.]rainv1sta[.]ru/rbhszhdc hxxps://gusty[.]rainv1sta[.]ru/z5c2xyh7 hxxps://medow[.]rainv1sta[.]ru/1awq7hvf hxxps://medow[.]rainv1sta[.]ru/hoj0kpyi hxxps://drizz[.]rainv1sta[.]ru/p1nv14tu hxxps://pfed[.]deepv0yage[.]ru/wy9xssa1 hxxps://dawne[.]brightden[.]ru/crjnupyb hxxps://dawne[.]brightden[.]ru/89b0bogd hxxps://gloww[.]brightden[.]ru/tn3o17q9 hxxps://turne[.]mistytrai1[.]ru/ju5kwiys hxxps://turne[.]mistytrai1[.]ru/wofytva2 hxxps://pfth[.]mistytrai1[.]ru/ah4jv641 hxxps://silem[.]s0ftvale[.]ru/0urf3oh4 |
ClearFake |
| URL | hxxps://dizelexcel[.]xyz/open/HVqKmlyoJ145[.]bin hxxps://dizelexcel[.]xyz/open/Urkrfters[.]mdp hxxps://candrikatravel[.]com/arquivo_20251118031956[.]txt hxxp://sits[.]inter[.]net[.]pk/SfyHmsQLeXRtjEtIQyDOG74[.]bin hxxps://dexios[.]co[.]za/SfyHmsQLeXRtjEtIQyDOG74[.]bin hxxps://clarune[.]life/plaque/XhtVGIsEZHz142[.]bin hxxps://da[.]denker[.]gq/res/Extremes[.]aca hxxps://clarune[.]life/plaque/Skimmede60[.]pcz |
CloudEyE |
| URL | hxxp://195[.]178[.]136[.]19/xmr[.]exe hxxps://151[.]53[.]100[.]5:8443/sda1/voicemail/Photo[.]scr hxxps://151[.]53[.]100[.]5:8443/sda1/Video[.]scr hxxps://151[.]53[.]100[.]5:8443/sda1/voicemail/AV[.]scr hxxps://151[.]53[.]100[.]5:8443/sda1/AV[.]scr hxxps://151[.]53[.]100[.]5:8443/sda1/voicemail/Video[.]scr hxxps://151[.]53[.]100[.]5:8443/sda1/Photo[.]scr hxxp://142[.]247[.]182[.]184/dev_hdd0/tmp/wm_res/info[.]zip |
Coinminer |
| URL | hxxps://health-smooth-eu2[.]com/t[.]hta hxxp://45[.]153[.]34[.]175/c4e3d825c1654e79[.]php |
Stealc |
| URL | hxxp://62[.]60[.]226[.]16:5553/999d49e5c25a428c9cfc04c2e455b6f4_crypted_build[.]exe | Rhadamanthys |
| URL | hxxp://178[.]16[.]55[.]189/files/2020593187/UT0no6Z[.]exe | Vidar |
| URL | hxxps://eco-technic-ls[.]com/metadata/template[.]php hxxps://eco-technic-ls[.]com/metadata/rag[.]js hxxps://naturecontrast[.]com/metadata/template[.]php hxxps://naturecontrast[.]com/metadata/rag[.]js |
NetSupportManager RAT |
| URL | hxxps://apraadhi[.]com/6h9k[.]js | KongTuke |
| URL | hxxp://sits[.]inter[.]net[.]pk/sudernesk[.]emz hxxp://104[.]168[.]0[.]133/J/foree[.]ps1 |
Remcos |
| URL | hxxps://dexios[.]co[.]za/Brkopsluth[.]emz hxxps://candrikatravel[.]com/arquivo_20251118050126[.]txt hxxps://candrikatravel[.]com/arquivo_20251118050108[.]txt hxxp://173[.]249[.]197[.]116/x/ffss[.]bat hxxp://173[.]249[.]197[.]116/x/Reader_en_install_Dll[.]bat hxxp://173[.]249[.]197[.]116/x/Reader_en_install[.]exe |
Formbook |
| URL | hxxp://104[.]168[.]0[.]133/J/chi[.]ps1 hxxp://104[.]168[.]0[.]133/J/D[.]ps1 hxxp://104[.]168[.]0[.]133/J/stein[.]ps1 hxxps://api[.]telegram[.]org/bot7632193240:AAF8666JYzsBZl74jbf9VqmJkv7rRn8Mrwc/ |
Agent Tesla |
| URL | hxxp://195[.]24[.]237[.]169/a-r[.]m-7[.]Sakura hxxp://195[.]24[.]237[.]169/m-p[.]s-l[.]Sakura hxxp://195[.]24[.]237[.]169/m-6[.]8-k[.]Sakura hxxp://195[.]24[.]237[.]169/s-h[.]4-[.]Sakura hxxp://195[.]24[.]237[.]169/a-r[.]m-6[.]Sakura hxxp://195[.]24[.]237[.]169/a-r[.]m-4[.]Sakura hxxp://195[.]24[.]237[.]169/x-3[.]2-[.]Sakura hxxp://195[.]24[.]237[.]169/i-5[.]8-6[.]Sakura hxxp://195[.]24[.]237[.]169/a-r[.]m-5[.]Sakura hxxp://195[.]24[.]237[.]169/p-p[.]c-[.]Sakura hxxp://195[.]24[.]237[.]169/m-i[.]p-s[.]Sakura hxxp://195[.]24[.]237[.]169/x-8[.]6-[.]Sakura |
Bashlite |
| URL | hxxp://38[.]147[.]172[.]78/02[.]08[.]2022[.]exe hxxp://42[.]51[.]39[.]153:9090/02[.]08[.]2022[.]exe hxxp://43[.]139[.]50[.]42:62213/02[.]08[.]2022[.]exe hxxp://47[.]236[.]149[.]142:46832/02[.]08[.]2022[.]exe hxxp://38[.]190[.]224[.]63/02[.]08[.]2022[.]exe hxxp://103[.]73[.]66[.]43/02[.]08[.]2022[.]exe hxxp://120[.]79[.]255[.]238:8088/02[.]08[.]2022[.]exe hxxp://47[.]107[.]136[.]106/02[.]08[.]2022[.]exe hxxp://47[.]121[.]137[.]8/02[.]08[.]2022[.]exe hxxp://174[.]138[.]24[.]216/02[.]08[.]2022[.]exe hxxp://166[.]117[.]156[.]6:21666/02[.]08[.]2022[.]exe hxxp://134[.]122[.]140[.]185/02[.]08[.]2022[.]exe hxxp://112[.]125[.]88[.]176:5555/02[.]08[.]2022[.]exe hxxp://117[.]72[.]184[.]172:81/02[.]08[.]2022[.]exe hxxp://47[.]121[.]193[.]38:81/02[.]08[.]2022[.]exe hxxp://154[.]64[.]254[.]204:18076/02[.]08[.]2022[.]exe hxxp://115[.]190[.]149[.]214:8848/02[.]08[.]2022[.]exe hxxp://156[.]245[.]248[.]173:8080/02[.]08[.]2022[.]exe hxxp://124[.]222[.]32[.]224:5678/02[.]08[.]2022[.]exe hxxp://106[.]75[.]224[.]31:8082/02[.]08[.]2022[.]exe hxxp://116[.]62[.]226[.]163/02[.]08[.]2022[.]exe hxxp://185[.]196[.]9[.]236/02[.]08[.]2022[.]exe hxxp://206[.]206[.]76[.]179:9999/02[.]08[.]2022[.]exe hxxp://47[.]239[.]188[.]48:8880/02[.]08[.]2022[.]exe hxxp://39[.]106[.]35[.]19/02[.]08[.]2022[.]exe hxxp://106[.]75[.]224[.]31:8081/02[.]08[.]2022[.]exe hxxp://121[.]229[.]205[.]238:8888/02[.]08[.]2022[.]exe hxxp://111[.]228[.]3[.]39:4433/02[.]08[.]2022[.]exe hxxp://47[.]100[.]168[.]4:8888/02[.]08[.]2022[.]exe hxxp://68[.]64[.]177[.]221:888/02[.]08[.]2022[.]exe hxxp://118[.]25[.]91[.]151/02[.]08[.]2022[.]exe hxxp://38[.]147[.]170[.]252:3233/02[.]08[.]2022[.]exe hxxp://36[.]134[.]91[.]64:9990/02[.]08[.]2022[.]exe hxxp://128[.]199[.]86[.]145:8080/02[.]08[.]2022[.]exe hxxp://82[.]156[.]235[.]177:8089/02[.]08[.]2022[.]exe hxxp://118[.]25[.]91[.]151:8084/02[.]08[.]2022[.]exe hxxp://110[.]40[.]174[.]104:8080/02[.]08[.]2022[.]exe hxxp://43[.]139[.]204[.]206:65510/02[.]08[.]2022[.]exe hxxp://49[.]234[.]46[.]15:58014/02[.]08[.]2022[.]exe hxxp://47[.]104[.]67[.]154/02[.]08[.]2022[.]exe hxxp://47[.]243[.]100[.]234:8081/02[.]08[.]2022[.]exe hxxp://123[.]249[.]67[.]241:8081/02[.]08[.]2022[.]exe hxxp://106[.]75[.]215[.]96:8081/02[.]08[.]2022[.]exe hxxp://156[.]233[.]233[.]134/02[.]08[.]2022[.]exe hxxp://38[.]190[.]227[.]110:9989/02[.]08[.]2022[.]exe hxxp://165[.]154[.]125[.]212:8080/02[.]08[.]2022[.]exe hxxp://112[.]125[.]88[.]176/02[.]08[.]2022[.]exe hxxp://54[.]166[.]128[.]216/02[.]08[.]2022[.]exe hxxp://18[.]170[.]31[.]191:8888/02[.]08[.]2022[.]exe hxxp://34[.]169[.]71[.]114:4041/02[.]08[.]2022[.]exe hxxp://23[.]95[.]108[.]174:8990/02[.]08[.]2022[.]exe hxxp://43[.]156[.]74[.]19:20080/02[.]08[.]2022[.]exe hxxp://82[.]146[.]49[.]236:9435/02[.]08[.]2022[.]exe |
Cobalt Strike |
| URL | hxxps://goboadvertising[.]autodealertech[.]co/AwsSmtpCracked[.]exe hxxps://goboadvertising[.]autodealertech[.]co/EmailVerify[.]exe |
XWorm |
| URL | hxxp://178[.]16[.]55[.]189/files/5750743047/rF606wl[.]exe | SalatStealer |
| URL | hxxp://178[.]16[.]55[.]189/files/1671711641/WLEkZwB[.]exe | PureLogs Stealer |
| URL | hxxps://kengesrakishev-sanctions[.]com/wp-content/file/vib[.]ps1 hxxps://positivepay-messages[.]com/file/wig[.]ps1 hxxps://positivepay-messages[.]com/file/german[.]ps1 hxxps://www[.]mediafire[.]com/file_premium/5zd8kc4kjgkm3ud/Adobe[.]9[.]8[.]1[.]1[.]Installer[.]wsf/file hxxps://www[.]mediafire[.]com/file/b75y9ikzc07692f/FACTURA+74r02797291025[.]wsf hxxp://20[.]89[.]76[.]13/134/dsfsdofw0gge0gf0h0e0et34ertiurt090tfd9dfgt3tter0d9gd0fg0gg0dg0d0g0dfg0cvb0[.]hta |
Stealerium |
