Skip to content

Public IOC feed / Traffic distribution

Traffic distribution

Traffic brokers, redirectors and traffic distribution systems that send victims onward.

25 high-confidence indicators from the last 30 days of security reporting. Free, refreshed hourly, no login, CC-BY.

Files

With an API key: /api/public/v1/iocs/feed?category=traffic_distribution. API reference

Newest indicators

Showing 25 of 25.

  • uzyzx.com domain, 1 Nov

    Used as a distribution host for repackaged applications Source

  • 66wc.eu.cc domain, 29 Oct

    Domain used for tracking and configuration in the Coruna campaign. Source

  • jiaoyou.eu.cc domain, 29 Oct

    Domain variant used in attack chain configurations. Source

  • xxtg1.eu.cc domain, 29 Oct

    Domain used for tracking and configuration in the Coruna campaign. Source

  • claude.ai.download-app.us domain, 27 Oct

    Redirects users to malicious content. Source

  • leqdger.click domain, 24 Oct

    Misspelling of a legitimate brand used in the campaign Source

  • cartoonmines.com domain, 19 Oct

    Used in redirect scripts for malicious traffic Source

  • splittous.com domain, 19 Oct

    Used in redirect scripts for malicious traffic Source

  • starbuck.xyz domain, 19 Oct

    Used in redirect scripts for malicious traffic Source

  • life4life.org domain, 17 Oct

    Used as a traffic broker in malicious activity. Source

  • sdk.araleads.com domain, 17 Oct

    Used in malicious traffic generation. Source

  • shoppiing.org domain, 17 Oct

    Used as a traffic broker in malicious activity. Source

  • cuturl.app domain, 16 Oct

    Flagged for suspicious registration characteristics Source

  • cuturl.space domain, 16 Oct

    Flagged for suspicious registration characteristics Source

  • instagrarn.co domain, 16 Oct

    Flagged for suspicious registration characteristics Source

  • llink.link domain, 16 Oct

    Flagged for suspicious registration characteristics Source

  • url-tiny.co domain, 16 Oct

    Flagged for suspicious registration characteristics Source

  • useproof.cc domain, 16 Oct

    Linked to Candiru and matched fingerprint CF3 Source

  • goalods.lol domain, 15 Oct

    Listed as a Hotejka affiliate domain Source

  • hotejka.com domain, 15 Oct

    Used as PTR record for malicious IP address Source

  • hotejka.ink domain, 15 Oct

    Primary affiliate site for Hotejka Source

  • hotns.rest domain, 15 Oct

    Nameserver used by Hotejka affiliates Source

  • trixsolvesxa.shop domain, 15 Oct

    Listed as a Hotejka affiliate domain Source

  • zylvantrexor.lol domain, 15 Oct

    Listed as a Hotejka affiliate domain Source

  • check.vykyn.click domain, 7 Oct

    Domain used for redirecting visitors as part of attacker-controlled operations. Source

Think one of these is wrong? Email [email protected].

Other categories