{
  "generated_at": "2026-09-22T07:39:13.225Z",
  "api_version": "v1",
  "disclaimer": "Aggregated from public sources. Freshness depends on upstream feeds; this is not a commercial threat-intel feed and carries no SLA. Verify before acting.",
  "attribution": [
    {
      "name": "Feodo Tracker (abuse.ch)",
      "url": "https://feodotracker.abuse.ch/",
      "licence": "CC0, see abuse.ch terms"
    },
    {
      "name": "ThreatFox (abuse.ch)",
      "url": "https://threatfox.abuse.ch/",
      "licence": "CC0, see abuse.ch terms"
    }
  ],
  "sources": [
    {
      "name": "Feodo Tracker",
      "ok": true,
      "count": 5,
      "response_ms": 289,
      "error": null
    },
    {
      "name": "ThreatFox",
      "ok": true,
      "count": 60,
      "response_ms": 853,
      "error": null
    }
  ],
  "count_total_available": 26,
  "limit_applied": 500,
  "count": 26,
  "indicators": [
    {
      "type": "ip:port",
      "value": "159.203.178.139:9034",
      "context": "Aisuru",
      "tags": [
        "threatfox",
        "aisuru"
      ],
      "seenAt": "2026-09-22 07:10:42 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927245/"
    },
    {
      "type": "ip:port",
      "value": "111.230.37.219:22",
      "context": "Cobalt Strike",
      "tags": [
        "threatfox",
        "cobalt strike"
      ],
      "seenAt": "2026-09-22 07:05:07 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927243/"
    },
    {
      "type": "ip:port",
      "value": "121.43.58.113:80",
      "context": "Cobalt Strike",
      "tags": [
        "threatfox",
        "cobalt strike"
      ],
      "seenAt": "2026-09-22 07:05:06 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927241/"
    },
    {
      "type": "ip:port",
      "value": "121.43.58.113:8080",
      "context": "Cobalt Strike",
      "tags": [
        "threatfox",
        "cobalt strike"
      ],
      "seenAt": "2026-09-22 07:05:06 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927242/"
    },
    {
      "type": "ip:port",
      "value": "121.43.58.113:443",
      "context": "Cobalt Strike",
      "tags": [
        "threatfox",
        "cobalt strike"
      ],
      "seenAt": "2026-09-22 07:05:05 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927240/"
    },
    {
      "type": "ip:port",
      "value": "138.68.168.41:34567",
      "context": "Aisuru",
      "tags": [
        "threatfox",
        "aisuru"
      ],
      "seenAt": "2026-09-22 06:54:59 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927238/"
    },
    {
      "type": "ip:port",
      "value": "159.223.150.218:2538",
      "context": "Remus",
      "tags": [
        "threatfox",
        "remus"
      ],
      "seenAt": "2026-09-22 06:50:17 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927236/"
    },
    {
      "type": "ip:port",
      "value": "134.209.106.204:34567",
      "context": "Aisuru",
      "tags": [
        "threatfox",
        "aisuru"
      ],
      "seenAt": "2026-09-22 06:39:08 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927235/"
    },
    {
      "type": "ip:port",
      "value": "104.249.10.101:7004",
      "context": "XWorm",
      "tags": [
        "threatfox",
        "xworm"
      ],
      "seenAt": "2026-09-22 06:20:24 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927231/"
    },
    {
      "type": "ip:port",
      "value": "149.88.73.83:8080",
      "context": "Cobalt Strike",
      "tags": [
        "threatfox",
        "cobalt strike"
      ],
      "seenAt": "2026-09-22 06:05:07 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927211/"
    },
    {
      "type": "ip:port",
      "value": "149.88.73.83:8000",
      "context": "Cobalt Strike",
      "tags": [
        "threatfox",
        "cobalt strike"
      ],
      "seenAt": "2026-09-22 06:05:07 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927212/"
    },
    {
      "type": "ip:port",
      "value": "105.158.184.236:8808",
      "context": "AsyncRAT",
      "tags": [
        "threatfox",
        "asyncrat"
      ],
      "seenAt": "2026-09-22 06:05:07 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927213/"
    },
    {
      "type": "ip:port",
      "value": "149.88.73.83:80",
      "context": "Cobalt Strike",
      "tags": [
        "threatfox",
        "cobalt strike"
      ],
      "seenAt": "2026-09-22 06:05:05 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927210/"
    },
    {
      "type": "ip:port",
      "value": "149.88.73.83:443",
      "context": "Cobalt Strike",
      "tags": [
        "threatfox",
        "cobalt strike"
      ],
      "seenAt": "2026-09-22 06:05:04 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927209/"
    },
    {
      "type": "ip:port",
      "value": "94.154.43.12:33",
      "context": "Mirai",
      "tags": [
        "threatfox",
        "mirai"
      ],
      "seenAt": "2026-09-22 05:29:45 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927206/"
    },
    {
      "type": "ip:port",
      "value": "207.57.125.216:8084",
      "context": "VShell",
      "tags": [
        "threatfox",
        "vshell"
      ],
      "seenAt": "2026-09-22 05:05:07 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927132/"
    },
    {
      "type": "ip:port",
      "value": "149.88.73.83:22",
      "context": "Cobalt Strike",
      "tags": [
        "threatfox",
        "cobalt strike"
      ],
      "seenAt": "2026-09-22 05:05:07 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927133/"
    },
    {
      "type": "ip:port",
      "value": "102.117.169.159:7443",
      "context": "Unknown malware",
      "tags": [
        "threatfox",
        "unknown malware"
      ],
      "seenAt": "2026-09-22 05:05:06 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927130/"
    },
    {
      "type": "ip:port",
      "value": "45.8.46.122:8090",
      "context": "Unknown malware",
      "tags": [
        "threatfox",
        "unknown malware"
      ],
      "seenAt": "2026-09-22 05:05:06 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927131/"
    },
    {
      "type": "ip:port",
      "value": "78.17.212.127:8080",
      "context": "Cobalt Strike",
      "tags": [
        "threatfox",
        "cobalt strike"
      ],
      "seenAt": "2026-09-22 05:05:05 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1927129/"
    },
    {
      "type": "ip:port",
      "value": "128.90.103.184:2015",
      "context": "Remcos",
      "tags": [
        "threatfox",
        "remcos"
      ],
      "seenAt": "2026-09-22 05:00:45 UTC",
      "source": "ThreatFox (abuse.ch)",
      "sourceKey": "ThreatFox",
      "link": "https://threatfox.abuse.ch/ioc/1926658/"
    },
    {
      "type": "ip",
      "value": "27.133.154.218",
      "context": "QakBot · offline · port 443 · SAKURA-B SAKURA Internet Inc.",
      "online": false,
      "tags": [
        "c2",
        "botnet",
        "qakbot"
      ],
      "seenAt": "2026-03-04 14:28:39",
      "source": "Feodo Tracker (abuse.ch)",
      "sourceKey": "Feodo Tracker",
      "link": "https://feodotracker.abuse.ch/browse/host/27.133.154.218/"
    },
    {
      "type": "ip",
      "value": "178.62.3.223",
      "context": "QakBot · offline · port 443 · DIGITALOCEAN-ASN - DigitalOcean, LLC",
      "online": false,
      "tags": [
        "c2",
        "botnet",
        "qakbot"
      ],
      "seenAt": "2026-02-17 05:41:23",
      "source": "Feodo Tracker (abuse.ch)",
      "sourceKey": "Feodo Tracker",
      "link": "https://feodotracker.abuse.ch/browse/host/178.62.3.223/"
    },
    {
      "type": "ip",
      "value": "34.204.119.63",
      "context": "QakBot · offline · port 443 · AMAZON-AES",
      "online": false,
      "tags": [
        "c2",
        "botnet",
        "qakbot"
      ],
      "seenAt": "2026-01-13 21:41:15",
      "source": "Feodo Tracker (abuse.ch)",
      "sourceKey": "Feodo Tracker",
      "link": "https://feodotracker.abuse.ch/browse/host/34.204.119.63/"
    },
    {
      "type": "ip",
      "value": "50.16.16.211",
      "context": "QakBot · online · port 443 · AMAZON-AES",
      "online": true,
      "tags": [
        "c2",
        "botnet",
        "qakbot"
      ],
      "seenAt": "2025-12-30 13:56:31",
      "source": "Feodo Tracker (abuse.ch)",
      "sourceKey": "Feodo Tracker",
      "link": "https://feodotracker.abuse.ch/browse/host/50.16.16.211/"
    },
    {
      "type": "ip",
      "value": "162.243.103.246",
      "context": "Emotet · offline · port 8080 · DIGITALOCEAN-ASN",
      "online": false,
      "tags": [
        "c2",
        "botnet",
        "emotet"
      ],
      "seenAt": "2022-06-04 21:24:53",
      "source": "Feodo Tracker (abuse.ch)",
      "sourceKey": "Feodo Tracker",
      "link": "https://feodotracker.abuse.ch/browse/host/162.243.103.246/"
    }
  ]
}