Formbook - Distribution Methods
File types, delivery vectors, and hosting infrastructure used to distribute Formbook.
Last updated: 2026-08-09
Understanding how Formbook reaches victims is critical for prevention. This page breaks down the file types used in distribution, the hosting infrastructure serving malicious payloads, and URLs tracked by URLhaus. Data is updated daily.
What Distribution Data Tells You
Shifts in file type distribution often signal changes in delivery tactics. For example, a move from .exe to .msi files may indicate operators adapting to Windows SmartScreen or email gateway filtering. A surge in .js or .vbs files suggests script-based delivery through phishing emails. Monitoring these patterns helps you tune your email security gateway rules and endpoint protection policies to block the current delivery method before it reaches end users.
Hosting Infrastructure
The hosting data below shows which domains and servers are actively distributing Formbook payloads. Add these to your DNS blocklists, web proxy deny rules, and firewall policies. Hosting infrastructure tends to rotate frequently as takedowns occur, so check this page regularly. All URL data is sourced from URLhaus. For hash-based indicators, see the IOC page. For sample details, see Formbook samples.
File Types (500 samples)
js 212 (42%)
exe 200 (40%)
vbs 31 (6%)
rar 18 (4%)
zip 9 (2%)
bat 9 (2%)
hta 8 (2%)
xlsm 6 (1%)
rtf 3 (1%)
ps1 2 (0%)
7z 1 (0%)
lnk 1 (0%)
Malicious Distribution URLs (143)
http://178.16.53.176/HTTP/kcrypted.ps1 https://durakutihs.com/.well-known/acme-challenge/sma.exe http://216.9.224.48/xz/bin%20(2)upload%20(1).txt https://golvteametvarberg.se/wp-content/admin/bin.exe https://sweet-snowflake-8a7e.uploadesclintesss.workers.dev/sdXBP https://sales.ifree.page/img_131252.png https://cashblaq.fit/bin.exe http://217.60.241.35/crypted.ps1 https://hjha.ao/file/bin.dat https://sweet-snowflake-8a7e.uploadesclintesss.workers.dev/znIcB https://simplejack.lovestoblog.com/img_231339.png http://107.173.62.98/12345/crypted.ps1 https://drive.google.com/uc?export=download&id=1lWriYvaLQHR4VbRAJyyukuXtocZJbdOQ https://ufavalkplus.com/wp-admin/bin.exe https://malaysianpastrybakery.org/teamm.ps1 https://customcreationsmaine.com/db22/bin.exe https://drive.google.com/uc?export=download&id=1uP6eeZrFYoO4FDTkMKWOHntx-Hx7ULJj https://drive.google.com/uc?export=download&id=1rG8PN8efU6NPnWc2RyoyuL9wtjMo4Uz_ https://kgbhost.digital/kingboss/uploads/bin.exe https://kiabillc.online/dndjonse/jqqc3S9hjjnxxzKjqmTMtgt9S4mMqMoKGsHEjw2jjce4gv.js https://galdum.ro/.well-known/pki-validation/bin.exe https://lucciodontologiaintegrada.com.br/16/zong.ps1 https://drive.google.com/uc?export=download&id=17JuKVHJTntEuxmW7r-IwQeFaEcTxl94U https://drive.google.com/uc?export=download&id=1WWfERNA9Y8IM-7DO4x6dAA7r1VlFNoTc https://drive.google.com/uc?export=download&id=1TMZqDplNRrNoGk2xvGsSEWrreA9pmFn7 https://drive.google.com/uc?export=download&id=1XDCI_1kQupUqDw_2gS8MLd8gAH3egA-D https://protector.great-site.net/img_081312.png https://misty-cherry-cea3.uploadsimg.workers.dev/FtqFC https://drive.google.com/uc?export=download&id=1Ilj9nZvE-p9PYMCjy-EgwCUWtlyPAdS8 https://lucciodontologiaintegrada.com.br/15/dbs.ps1 https://xevzora.cfd/2day/secured_stub.ps1 http://107.173.143.45/18/weneedgoodthingsforbetterplacescomiginthebestnetworking.hta https://drive.google.com/uc?export=download&id=1n8LUdSbC-n2L7oZyWFcNlXRA4ZLJWteM https://drive.google.com/uc?export=download&id=1JCwGIY3FJjWVB9TapEfUFCMnv-SF2-kY https://drive.google.com/uc?export=download&id=1Dmm3nDGqP_-N-KsiM0-zioCTJDQYonyt https://drive.google.com/uc?export=download&id=1ObSjRfAxe5D8je8uZDmkgk9kUs-nsQXs https://drive.google.com/uc?export=download&id=1PMY1L8vqsY1xDNu-FJshXgC8X3otXaFK https://drive.google.com/uc?export=download&id=17ivR2nQexwOGa4M4n2EC3jSNK6U1L3VP https://drive.google.com/uc?export=download&id=194Tdr8JIZMjhUah53b9upptKKsJOS0es https://crypter.howto.rocks/img_225526.png https://shy-hall-9c09.cryptersandtoolsoficial.workers.dev/pQDyy https://desentupidora.pro.br/assets/MSI_PRODJ5TH.png https://anakort32ew.site/d/dstq.dat https://2019.ecoknights.org.my/components/stubaa.ps1 https://mail.avicennaalliedhealthinstitute.org/stubmy.ps1 https://files.catbox.moe/ffsa3b.ps1 https://blue-paper-f69f.acrypters.workers.dev/3TPO-G4N0-U714-L9KX/img_8bcbsz.png https://icy-lab-0431.guilherme-telecomunicacoes2024.workers.dev/FowaP https://mail.avicennaalliedhealthinstitute.org/stubblassed.ps1 https://mail.avicennaalliedhealthinstitute.org/stubcc.ps1 https://miki-visitasia.com/ebzWgQKY/pk.ps1 https://myzen.pro/a/bin.dat https://3008.filemail.com/api/file/get?filekey=wPRLcTEIw3X3AfMSaytStQ_sZzHNnOeuU1I3Rb06iOF_IPbX2DIlZKdd0yQ https://miki-visitasia.com/HMKiTXGt/stub.ps1 https://globaltechnosoft.com/dijoff/oFcdijj.txt https://comserlivuior.store/c/bin.dat https://comserlivuior.store/a/bin.dat https://comserlivuior.store/d/bin.dat https://comserlivuior.store/b/bin.dat https://usjcx.site/grc/bin.dat https://pingdisp.com/level/stub.ps1 https://pastefy.app/OOYrGc5d/raw https://paste.sensio.no/GonnaWilma https://www.normativatecnica.org/kim/kim.bin https://ksb.com.de/ps/ps.js https://ali-alomaritrading.cam/ag/Unexplain.psd https://trade-eprex.pro/wp-admin/network/wp-debug/stubz.ps1 https://sterich.online/a/bin.dat https://www.websenorllc.com/wordpress/jbcrdFS.txt https://paste.sensio.no/RovingRandy https://alkurdi-sa.cam/ap/Udpunktcp.toc https://clemanimpianti.it.com/UCC/KR.js https://drive.google.com/uc?export=download&id=1p6cT81hwfsLgFJlgPg8tN-8AFD8Q2cx4 https://jankop.shop/stego_payload23456.png http://107.173.9.85/68/simplecreationsforme.hta https://raptore.yzz.me/MSI_182414.png http://107.173.9.85/67/img_171102.png http://107.173.9.85/67/weneedbetterthingsforbest.HtA http://107.173.9.85/httpswww.veeam.comfree-hybrid-cloud-trial.htmlst=bingpaidsearch&utm_campaign_id=604987702&utm_adgroup=trial-hybrid-cloud-nb-backup&utm.php https://linkku.me/UFEzAA https://crypto-corexchange.com/wp-includes/theme-compat/higzbol/nstyjrw/rszqlut/fgeekpk.txt https://hasteb.in/h3Y7Duh1Nift0yD http://getamarin.ro/new-geta-marin-site/20426.exe http://www.vame.be/csi/update.ps1 https://stylegeneration.ma/sirdee.ps1 http://172.245.155.94/27/greatattitudeforme.hta http://66.63.170.9/129/goodthingsforbetterforme.hta https://github.com/Hyperbolic531/Makethen/raw/refs/heads/main/FD-830-0054.pif https://github.com/Hyperbolic531/Makethen/raw/refs/heads/main/bin.exe https://github.com/Hyperbolic531/Makethen/raw/refs/heads/main/client.exe https://github.com/Hyperbolic531/Makethen/raw/refs/heads/main/bvx1TflM4CXqqX8.pif https://firebasestorage.googleapis.com/v0/b/rodriakd-8413d.appspot.com/o/dll%2Fjs.txt?alt=media&token=09ada575-efa9-4dc8-b331-404723b5997a https://pastefy.app/xG06xOb9/raw https://crowe-avvens.site/newoworkable/newoworkable.txt https://crowe-avvens.site/newoworkable/aegbFib.txt https://accessible-peach-termite.myfilebase.com/ipfs/QmVcz1Lehhbv5V72FZqhKicrAFKg9j1erVeSHXLs2QMqCP https://accessible-peach-termite.myfilebase.com/ipfs/QmWHGWhRiZ1Fp5tMV32NUNcNkozWxETxQAc38xn7DuvyXR https://wintecs.store/file/anaAcac.txt https://pastefy.app/vLd5jkAz/raw https://shardaherbals.com/ooci/bin.dat
Source: URLhaus (abuse.ch). Updated: 2026-08-09
Hosting Infrastructure
| Host | URLs |
|---|---|
| drive.google.com | 18 |
| minel-lights.rs | 7 |
| katz.adv.br | 5 |
| comserlivuior.store | 4 |
| 107.173.9.85 | 4 |
| github.com | 4 |
| firebasestorage.googleapis.com | 4 |
| 91.92.241.197 | 4 |
| mail.avicennaalliedhealthinstitute.org | 3 |
| pastefy.app | 3 |
| gateway.lighthouse.storage | 3 |
| sweet-snowflake-8a7e.uploadesclintesss.workers.dev | 2 |
| lucciodontologiaintegrada.com.br | 2 |
| miki-visitasia.com | 2 |
| paste.sensio.no | 2 |
| crowe-avvens.site | 2 |
| accessible-peach-termite.myfilebase.com | 2 |
| au72nuxzv2.ufs.sh | 2 |
| almacensantangel.com | 2 |
| 178.16.53.176 | 1 |