不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様4社 -
2026/02/25
※2026/02/25 更新
マルウェア感染させると考えられるURLを検知（2026/02/25）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxps://area-grove-sync[.]brightgrove[.]ru/service/verification[.]google hxxps://light-grove-hub[.]brightgrove[.]ru/service/verification[.]google hxxps://fresh-cliff-high[.]freshcliff[.]ru/service/verification[.]google hxxps://js0qnoh0[.]alphasync[.]digital/?=check&&actmn=fmDDhGuxkEXfSMZy hxxps://summit-cliff-sync[.]freshcliff[.]ru/service/verification[.]google hxxps://geo-fresh-node[.]freshcliff[.]ru/service/verification[.]google hxxps://epi66tim[.]velocore[.]digital/?=check&&actmn=wsUuSdLFabxFwEvR hxxps://vbb24wmu[.]lumenbit[.]digital/?=check&&actmn=VTlUMkJJfPNLYUix hxxps://ovfs585i[.]urbanforge[.]digital/?=check&&actmn=dkHXBtBxmiLHInXf hxxps://2z0nkkls[.]lumenbit[.]digital/?=check&&actmn=WDIFGxQnsJnvHCPg hxxps://iwkzzjit[.]rapidmatrix[.]digital/?=check&&actmn=BZFHzfanLgdnWRJU hxxps://s2s942l0[.]modernsignal[.]digital/?=check&&actmn=tOFigKJcCVjIlDEQ |
ClearFake |
| URL | hxxps://googdownload[.]googcdngoogchromeleownload[.]top/download/googdownload/chroome[.]zip | Ghost RAT |
| URL | hxxp://130[.]12[.]180[.]43/files/6847912187/FnckCRv[.]exe | Vidar |
| URL | hxxps://raw[.]githubusercontent[.]com/stevencohn8888-max/hj/refs/heads/main/ENCRYPTED[.]ps1 | XWorm |
| URL | hxxps://sahammbank[.]help/SOSTENER2[.]vbs hxxps://sahammbank[.]help/SOSTENER2[.]js hxxps://sahammbank[.]help/SOSTENER2[.]bat |
Remcos |
| URL | hxxp://195[.]177[.]94[.]29:34265/s/kal64 hxxp://195[.]177[.]94[.]29:34265/s/kal32 hxxp://195[.]177[.]94[.]29:34265/s/kswpad |
BillGates |
| URL | hxxps://api[.]telegram[.]org/bot8498302719:AAGngGyPNP9afNCU6d6F66SbcyU5QH20yFQ/ | Agent Tesla |
| URL | hxxps://api[.]telegram[.]org/bot8177500259:AAHuZUtGMHUKkjN3M1Qi8DVi8S2hm8vMaiM/sendMessage?chat_id=7727828833 hxxps://api[.]telegram[.]org/bot7483316483:AAEMm8cH6cE_mUPZgH_KyQ-xJYirOx_EnVI/sendMessage?chat_id=6760229674 |
Snake Keylogger |
| URL | hxxp://130[.]12[.]180[.]43/files/7782139129/21ihkB1[.]exe | SantaStealer |
| URL | hxxp://65[.]21[.]200[.]30/1b8295a7e0284b08[.]php | Stealc |
| URL | hxxp://154[.]221[.]21[.]196:8443/jquery-3[.]3[.]1[.]min[.]js | Cobalt Strike |
| URL | hxxps://api[.]telegram[.]org/bot8556517765:AAHENwPtkFsom2b-TzkvB7Bp89xNbp5LjPM/sendMessage?chat_id=6616930993 hxxps://niril[.]sbs/OGR/SECURE[.]Ps1 |
Stealerium |
| URL | hxxp://5[.]61[.]40[.]97:8000/silent-deploy[.]ps1 | XMRig |
| URL | hxxps://lungx[.]hollower[.]sbs/LunX[.]zip hxxps://lunhx[.]hollower[.]sbs/LunX[.]zip hxxps://lunqv[.]hollower[.]sbs/LunX[.]zip |
PureCrypter |
| URL | hxxps://foodgefy[.]com/6o0jk[.]js hxxps://foodgefy[.]com/js[.]php |
KongTuke |
| URL | hxxp://84[.]38[.]129[.]77/UamaO168[.]bin | CloudEyE |
| URL | hxxps://ugurhuseyn[.]az/arquivo_20260224123824[.]txt | MASS Logger |
| URL | hxxp://130[.]12[.]180[.]43/files/7123159424/Q9pS2Uk[.]exe | SalatStealer |
| URL | hxxp://158[.]94[.]211[.]63/dealer/ConvertedFilesol[.]txt hxxp://158[.]94[.]211[.]63/dealer/gftrlls[.]txt hxxp://91[.]92[.]243[.]152/dealer/gftrlls[.]txt hxxp://91[.]92[.]243[.]152/dealer/oilandgasxwormugo[.]txt |
AsyncRAT |
| URL | hxxp://151[.]242[.]30[.]234/skid[.]arm6 | Bashlite |
| URL | hxxp://130[.]12[.]180[.]43/files/2038862353/5o1vzUb[.]exe | Coinminer |
| URL | hxxp://156[.]224[.]79[.]221/client | Melofee |
| URL | hxxp://62[.]60[.]226[.]159/bot[.]exe | RedLine Stealer |
