ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain hometwfrbas.com.

Database Entry


IOC ID:1854548
IOC: hometwfrbas.com
IOC Type :domain
Threat Type :payload_delivery
Malware: Unknown malware
Confidence Level : Confidence level is elevated (70%)
Is compromised? : True
ASN:AS399629 BLNWX
Country:- NL
First seen:2026-07-21 05:20:16 UTC
Last seen:never
UUID:e8e0d346-8483-11f1-8973-42010aa4000a
Reporter DENNISAROSS
Reward 5 credits from ThreatFox
Tags:BL-Networks cross-platform DGA-style-domain homebrew-lure jar java payload-delivery

Avatar
DENNISAROSS
Domain resolving to 64.52.80.235 (BL Networks AS399629) since 2026-07-04. Serves open directory of Java JAR malware payloads (4x ~706K files: Bubawo, Gewijenil, Nufuderi, homebrew) and paired shell script droppers. 'homebrew' targets macOS users. VT: 1 malicious (alphaMountain), 1 suspicious, flagged as newly registered. Co-located ASN with BlankGrabber staging and Banana RAT Brazilian banking trojan C2. JAR family TBD pending hash analysis.