s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2019801 high

📛 Threat Title

Mozi: URL that delivers a malware payload http://103.66.148.219:46462/Mozi.m

Category: Mozi Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: Mozi. Confidence: 75. First seen: 2026-11-08 00:18:50 UTC. Reporter: HoneyLabs. Tags: elf, IoT, Mozi.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

url http://103.66.148.219:46462/mozi.m

IOC database

Type
url
Value
http://103.66.148.219:46462/mozi.m
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
URL that delivers a malware payload attributed to Mozi

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (3)

  • External reference ThreatFox IOCs
  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: Mozi. Confidence: 75. First seen: 2026-11-08 00:18:50 UTC. Reporter: HoneyLabs. Tags: elf, IoT, Mozi.

Remediations (10)

  • Same Malware, New Servers: Investigating Mozi's October 2026 ...
    web:frameprivacy.com

    Triage sample 210112-jfqx11711x, from 12 January 2021, is that hash, submitted as Mozi.m. The same hash and the same MD5, eec5c6c219535fba3a0492ea8118b397, come back on 25 April 2022 as Mozi .aakzznwuh (220425-2dxcrsbdbq), on 24 September 2025 under the filename i (250924-ts5npazxct), on 15 August 2026 (260815-phk43swzcz), and on 8 October 2026 ...

  • Mozi Botnet: Evolving Threat to IoT Devices - hunt.io
    web:hunt.io

    Discover how the Mozi botnet exploits IoT vulnerabilities, its evolution, targeted sectors, and strategies to protect your devices from this persistent threat.

  • Mozi — IOCs, Behavior & Detection | SOCRadar
    web:ioc.socradar.io

    Mozi analysis — IOCs, C2 infrastructure, behavior patterns, detection hashes, and linked threat actors. Free lookup by SOCRadar.

  • Mozi malware — IOCs & CVEs | isMalicious
    web:ismalicious.com

    1,879 indicators of compromise attributed to the Mozi malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.

  • mozi — malware sample · Kinryū Labs
    web:kinryu.sh

    The bot delivers payloads peer to peer, running its own HTTP server at 0x4212b4 that serves thirteen per-architecture names, / Mozi . {m,a,b,c,x,4,6,7,k,l,p,r,s}, so a freshly exploited device fetches from the peer that infected it, at confidence 0.85.

  • ThreatFox | http://103.66.148.82:35099/Mozi.m
    web:threatfox.abuse.ch

    You are viewing the ThreatFox database entry for url http ://103.66.148.82:35099/ Mozi .m.

  • URLhaus | Malware URL exchange
    web:urlhaus.abuse.ch

    URLhaus URLhaus is a platform from abuse.ch and Spamhaus dedicated to sharing malicious URLs that are being used for malware distribution. Report URLs and explore the database for valuable intelligence. Use the APIs, to seamlessly push and pull signals, and automate bulk queries. With this intelligence, gain insights into malware behavior, to help identify, track, and mitigate against malware ...

  • Mozi IoT Botnet Malware: Analysis, Detection, Removal | Huntress
    web:www.huntress.com

    Mozi is a nasty piece of work derived from the source code of other IoT malware families like Mirai, Gafgyt, and IoT Reaper. It primarily functions as a P2P botnet, meaning infected devices communicate directly with each other instead of a centralized command-and-control (C2) server.

  • A new botnet attack just mozied into town - IBM
    web:www.ibm.com

    A relatively new player in the threat arena, the Mozi botnet, has spiked among Internet of things (IoT) devices, IBM X-Force has discovered. This malware has been active since late 2019 and has code overlap with Mirai and its variants. Mozi accounted for nearly 90% of the observed IoT network traffic from October 2019 through June 2020. This startling takeover was accompanied by a huge ...

  • How to proactively defend against Mozi IoT botnet
    web:www.microsoft.com

    Mozi is a peer-to-peer (P2P) botnet that uses a BitTorrent-like network to infect IoT devices such as network gateways and digital video records (DVRs). It works by exploiting weak telnet passwords1 and nearly a dozen unpatched IoT vulnerabilities2 and it's been used to conduct distributed denial-of-service (DDoS) attacks, data exfiltration, and command or payload execution.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.