不正URLへのアクセス、不正メールの受信
-
メール受信した
弊社お客様0社 URLアクセスした
弊社お客様1社 -
2026/08/31
※2026/08/31 更新
マルウェア感染させると考えられるURLを検知（2026/08/31）
■IoC（※1）
| Type: | IOC: | Signature: |
|---|---|---|
| URL | hxxp://fezm[.]website:9048/payments hxxp://crimsve[.]click:8954/imports hxxp://flreaow[.]click:6527/products hxxp://steadsp[.]click:8321/folders hxxp://fezm[.]website:9048/folders hxxp://flreaow[.]click:6527/subscriptions hxxp://flreaow[.]click:6527/accounts hxxp://luwerae[.]click:7748/articles hxxp://piarl[.]site:9048/tasks hxxp://piarl[.]site:9048/reviews hxxp://flreaow[.]click:6527/tags hxxp://piarl[.]site:9048/profiles hxxp://nopxs[.]shop:8839/users hxxp://uiccvbk[.]click:8839/addresses hxxp://gofkaxz[.]click:8137/sessions hxxp://piarl[.]site:9048/messages hxxp://flreaow[.]click:6527/files hxxp://piarl[.]site:9048/categories hxxp://piarl[.]site:9048/invoices hxxp://shhsift[.]click:7647/events hxxp://darkfot[.]click:3215/transactions hxxp://shhsift[.]click:7647/contacts hxxp://piarl[.]site:9048/accounts hxxp://piarl[.]site:9048/posts hxxp://flreaow[.]click:6527/categories hxxp://fresok[.]top:9048/accounts hxxp://cryptovectorhub3[.]lol:5478/messages hxxp://piarl[.]site:9048/collections hxxp://flreaow[.]click:6527/articles hxxp://piarl[.]site:9048/notifications hxxp://piarl[.]site:9048/documents hxxp://flreaow[.]click:6527/comments hxxp://shhsift[.]click:7647/orders hxxp://piarl[.]site:9048/imports hxxp://spareon[.]click:8811/folders hxxp://xightne[.]click:7242/tokens hxxp://fezm[.]website:9048/webhooks hxxp://flreaow[.]click:6527/imports hxxp://cdire[.]shop:9048/contacts hxxp://shhsift[.]click:7647/customers hxxp://cdire[.]shop:9048/files hxxp://flreaow[.]click:6527/images hxxp://mountat[.]click:7528/tokens hxxp://shhsift[.]click:7647/products hxxp://flreaow[.]click:6527/customers hxxp://cdire[.]shop:9048/images hxxp://flreaow[.]click:6527/messages hxxp://uiccvbk[.]click:8839/notifications hxxp://cdire[.]shop:9048/imports hxxp://cdire[.]shop:9048/documents hxxp://zonxh[.]shop:7728/reports hxxp://kupzovo[.]shop:7567/reports hxxp://cdire[.]shop:9048/messages hxxp://cdire[.]shop:9048/subscriptions hxxp://flreaow[.]click:6527/tasks hxxp://cdire[.]shop:9048/posts hxxp://cdire[.]shop:9048/tokens hxxp://cdire[.]shop:9048/webhooks hxxp://urbandm[.]click:4812/documents hxxp://cdire[.]shop:9048/videos hxxp://gofkaxz[.]click:8137/invoices hxxp://cdire[.]shop:9048/transactions |
Remus |
| URL | hxxps://cloudfeeld[.]com/check hxxps://clickzona[.]net/embed/ |
IClickFix |
| URL | hxxp://103[.]186[.]77[.]70:50625/Mozi[.]m hxxp://43[.]230[.]94[.]184:39786/Mozi[.]m hxxp://175[.]107[.]38[.]23:49747/Mozi[.]m hxxp://153[.]117[.]40[.]227:53474/Mozi[.]m hxxp://202[.]163[.]68[.]10:47266/Mozi[.]m hxxp://91[.]234[.]62[.]215:57642/Mozi[.]m hxxp://59[.]97[.]250[.]11:43040/Mozi[.]m hxxp://14[.]1[.]104[.]86:52889/Mozi[.]m hxxp://113[.]90[.]49[.]232:46655/Mozi[.]m hxxp://39[.]89[.]242[.]234:38903/Mozi[.]m hxxp://39[.]34[.]189[.]248:42346/Mozi[.]m hxxp://203[.]101[.]186[.]166:41052/Mozi[.]m hxxp://139[.]135[.]42[.]31:43969/Mozi[.]m hxxp://103[.]26[.]82[.]216:35366/Mozi[.]m hxxp://175[.]107[.]0[.]8:44034/Mozi[.]7 hxxp://112[.]25[.]235[.]194:60134/Mozi[.]7 hxxp://116[.]109[.]33[.]252:33235/Mozi[.]a hxxp://153[.]117[.]37[.]70:33874/Mozi[.]m hxxp://139[.]135[.]40[.]153:53926/Mozi[.]m hxxp://124[.]29[.]214[.]104:35063/Mozi[.]m hxxp://153[.]117[.]32[.]82:36030/Mozi[.]m hxxp://103[.]237[.]157[.]163:56063/Mozi[.]m hxxp://103[.]148[.]128[.]156:45276/Mozi[.]m hxxp://36[.]255[.]33[.]242:53631/Mozi[.]a |
Mozi |
| URL | hxxp://91[.]92[.]242[.]236/files-129312398/files/file_274601599365ef96[.]exe | Lumma Stealer |
| URL | hxxp://91[.]92[.]242[.]236/files-129312398/files/file_da5806c64db79315[.]exe | Stealc |
| URL | hxxps://easyaround[.]st/img_111847[.]png hxxps://easyaround[.]st/MSI_PRO[.]png hxxps://coolairesgroup[.]com/img_051638[.]png hxxps://tmcksa[.]com/APAGO/pago[.]exe hxxps://dipre[.]com[.]tr/25/stego_i7rkf2ladi[.]png hxxps://alphasaling[.]site/stego_95t70lfg5l[.]png hxxps://raw[.]githubusercontent[.]com/bbaltaci90/jones/refs/heads/main/remcos_a[.]exe hxxps://tokidsa[.]com/Invoice/crypted[.]ps1 hxxps://tokidsa[.]com/Invoice/remcos_a%2832bit%29v3[.]1[.]exe hxxps://easyaround[.]st/img_022850[.]png hxxps://easyaround[.]st/img_020822[.]png hxxps://smarthomy[.]cl/svchost/64bitxxblessings[.]exe hxxps://coolairesgroup[.]com/img_170820[.]png |
Remcos |
| URL | hxxps://tokidsa[.]com/SOA/SOA[.]js hxxps://tokidsa[.]com/SOA/crypted[.]ps1 |
XWorm |
| URL | hxxps://www[.]eleganceclub[.]xyz/wp-includes/vi/crypted[.]ps1 | Warzone RAT |
| URL | hxxps://gaiadeqi[.]com/stego_cdyg6hf6tx[.]png | PureLogs Stealer |
| URL | hxxps://munihuacho[.]gob[.]pe//sifyWeb/MSI_PRO[.]png | Agent Tesla |
| URL | hxxps://packmate[.]in/LtUHpIfVXKoIfkhmgiAO172[.]bin | CloudEyE |
| URL | hxxps://impectorinternational[.]com/kaka/stego_jwfhjrnszg[.]png hxxps://impectorinternational[.]com/dot/a1[.]png |
HypeAgent |
| URL | hxxps://5[.]253[.]59[.]16/k/jjscotttbpl[.]dat | MASS Logger |
| URL | hxxp://111[.]185[.]147[.]232:59432/Mozi[.]m | Mirai |
| URL | hxxp://176[.]65[.]139[.]140/bins/i686 hxxp://91[.]208[.]197[.]218/bins/kworkerd |
Bashlite |
| URL | hxxps://render-6[.]com/api/metrics/run?event=pasted hxxps://trekworkshop3[.]com/2kqYRM0DCrnyJgoS4gVLl_FHDRRdTUhGCbjyuYwpZ6c/oo9/update |
Cobalt Strike |
| URL | hxxps://daskljtitaskastvv[.]pro/dsasfd555[.]js | NetSupportManager RAT |
| URL | hxxps://rabbitfuns[.]su/main/powershell[.]exe | Coinminer |
| URL | hxxps://dasgems[.]com/prosetup[.]exe | Overlord RAT |
| URL | hxxp://118[.]107[.]6[.]183/132[.]exe hxxp://118[.]107[.]6[.]183/cs2[.]exe hxxp://103[.]45[.]66[.]107/118[.]exe |
AsyncRAT |
| URL | hxxp://103[.]45[.]66[.]107/103[.]exe hxxp://103[.]45[.]66[.]107/192[.]exe |
Venom RAT |
