🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain cdn.youshouldvecomeover.lol.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1971699
IOC: cdn.youshouldvecomeover.lol
IOC Type :domain
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS16276 OVH
Country:- FR
First seen:2026-10-18 06:10:31 UTC
Last seen:never
UUID:d269335f-ca43-11f1-bd13-42010aa4000a
Reporter mikemich
Reward 5 credits from ThreatFox
Tags:auditpolcore DLL-sideloading OVH
Reference: https://www.virustotal.com/gui/file/4d05b7ecd6db6ed76e6e5597f4e8a3f36ac3b55dd16874977b4b0db365291e6c

Avatar
mikemich
C2 domains for auditpolcore.dll (DLL sideloading, delivered via Python39.rar). Registered 2026-10-05 (Namecheap, Cloudflare NS); resolve to 51.222.140.50 and 51.195.40.238 (OVH). Same servers previously hosted we-love-the.world and make-internet-safer-for-the.world (VT passive DNS). Passive sensor has observed Windows clients beaconing since 2026-10-14: GET /c/<100-char base64url token> with TLS SNI = these domains, synchronized rounds ~8h.