cdns3.51quickfox[.]cnDomain
Reported by 1 independent source · first reported by Fortinet Threat Research · last reported
Last reported 2 months ago
What the reports say
1 report, newest first · the exact sentence from each-
QuickFox Supply Chain Attack Used to Deploy FDMTP Implant“The next stage of the JavaScript involves downloading the zip file ‘update.zip’ from the previous C2 via a web request to ‘hxxp://cdns3.51quickfox[.]cn/2025090411/update.zip’ and saving it to ‘%TEMP%\quickfox\update.zip’.”
Indicators reported together
named in the same reports- cdns3.51quickfox[.]comin 1 report
- 51quickfox[.]cnin 1 report
- domain51quickfox.comcdns3.51quickfox[.]cnin 1 report
- hxxp://cdns3.51quickfox[.]cn/2025090411/update.zip%E2%80%99in 1 report
- 2b6cdafdfe427a3d…5b73185ed01cin 1 report
- 795594ad5e6f2868…de9a98528fb9in 1 report
- www.icloud-cdn[.]netin 1 report
- www.google-apis.netwww.google-apis[.]netin 1 report
- www.google-apis[.]netin 1 report
- www.icloud-cdn.netwww.icloud-cdn[.]netin 1 report
- www.wangmeng.xyzwww.wangmeng[.]xyzin 1 report
- www.wangmeng[.]xyzin 1 report
- www.wangmengsb.comwww.wangmengsb[.]comin 1 report
- www.wangmengsb[.]comin 1 report
- www.wangmeng66.topwww.wangmeng66[.]topin 1 report
- www.wangmeng66[.]topin 1 report
- www.techcheck1.comwww.techcheck1[.]comin 1 report
- www.techcheck1[.]comin 1 report
- 47.238.64.56www.yahoo-cdn[.]itin 1 report
- 47.239.4.179www.wangmengsb[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.