Formbook - Distribution Methods
File types, delivery vectors, and hosting infrastructure used to distribute Formbook.
Last updated: 2026-10-04
Understanding how Formbook reaches victims is critical for prevention. This page breaks down the file types used in distribution, the hosting infrastructure serving malicious payloads, and URLs tracked by URLhaus. Data is updated daily.
What Distribution Data Tells You
Shifts in file type distribution often signal changes in delivery tactics. For example, a move from .exe to .msi files may indicate operators adapting to Windows SmartScreen or email gateway filtering. A surge in .js or .vbs files suggests script-based delivery through phishing emails. Monitoring these patterns helps you tune your email security gateway rules and endpoint protection policies to block the current delivery method before it reaches end users.
Hosting Infrastructure
The hosting data below shows which domains and servers are actively distributing Formbook payloads. Add these to your DNS blocklists, web proxy deny rules, and firewall policies. Hosting infrastructure tends to rotate frequently as takedowns occur, so check this page regularly. All URL data is sourced from URLhaus. For hash-based indicators, see the IOC page. For sample details, see Formbook samples.
File Types (500 samples)
js 259 (52%)
exe 153 (31%)
vbs 23 (5%)
ps1 18 (4%)
vbe 8 (2%)
rar 8 (2%)
hta 6 (1%)
xlsm 6 (1%)
bat 5 (1%)
wsf 4 (1%)
rtf 4 (1%)
zip 4 (1%)
xls 1 (0%)
7z 1 (0%)
Malicious Distribution URLs (200)
https://hjha.ao/news1/secured_stub.ps1 https://www.correa.ind.br/wp-includes/Text/bnguyj1/qbg1plo/ytlfv1i/cc/securedd_stub.ps1 http://87130921-60-20220830152356.webstarterz.com/new/secured_stub.ps1 http://87130921-60-20220830152356.webstarterz.com/secured_stub.ps1 http://107.172.235.223/img/3.jpg https://tutpaste.com/raw/Q88luv http://172.245.209.172/55/img_94905005050.JPG.jS http://107.173.227.126/59/noc.jS https://reinigung-kosanke.de/wp-includes/theme-compat/qmxythi/baw1uqm/dvwqpnh/myCRYPTED_STUB.ps1 http://107.173.227.126/59/image_00040404.jpg.hta https://reinigung-kosanke.de/wp-includes/theme-compat/qmxythi/baw1uqm/dvwqpnh/22CRYPTED_STUB.ps1 https://hjha.ao/phil/secured_stub.ps1 https://reinigung-kosanke.de/wp-includes/theme-compat/qmxythi/baw1uqm/dvwqpnh/OJCRYPTED_STUB.ps1 https://reinigung-kosanke.de/wp-includes/theme-compat/qmxythi/baw1uqm/dvwqpnh/MCRYPTED_STUB.ps1 http://158.94.210.129/IP/CRYPTED_STUB.ps1 http://158.94.210.129/ID/CRYPTED_STUB.ps1 http://158.94.210.129/GMT/GCRYPTED_STUB.ps1 http://104.168.70.171/w4RVHQN7 http://158.94.210.129/GMT/kkCRYPTED_STUB.ps1 http://158.94.210.129/GMT/kCRYPTED_STUB.ps1 http://158.94.210.129/GMT/HCRYPTED_STUB.ps1 https://mhmehadi.top/Cryptedd.ps1 http://surun.info/nh1ykmf/qagxfjr/cc/Cryptedt.ps1 http://158.94.210.129/DV/AKCRYPTED_STUB.ps1 http://158.94.210.129/DV/OJCRYPTED_STUB.ps1 http://158.94.210.129/DV/CRYPTED_STUB.ps1 http://158.94.210.129/DV/millsCRYPTED_STUB.ps1 https://firebasestorage.googleapis.com/v0/b/julyendingapama.firebasestorage.app/o/kingjoo.png?alt=media&token=36145a21-d722-4709-9287-f8d67e90830a http://216.9.224.48/100/cFghrke.txt http://45.141.21.100/host/newt.ps1 https://surun.info/nh1ykmf/qagxfjr/cc/Cryptemd.ps1 https://surun.info/nh1ykmf/qagxfjr/cc/crypted.ps1 http://216.9.224.48/90/krjcbec.txt https://tripfarely.com/images/4.jpg https://productoslili.cl/cv/cr.exe https://productoslili.cl/cv/cr1.exe https://productoslili.cl/cv/IBAN.zip https://dugovicova.sk/wp-includes/sitemaps/kt1clur/xncdptb/corxlek/crypted.ps1 https://hotelmate.asia/wp-includes/theme-compat/xmorule/qapwsbu/nwshuf1/KMcrypted.ps1 https://hotelmate.asia/wp-includes/theme-compat/xmorule/qapwsbu/nwshuf1/crypted.ps1 http://safeifm.com/wp-admin/maint/bin.exe https://promnet.jp/components/com_media/yrxeqmt/mpzjoiq/udskwfe/cngrce.ps1 https://lp.afonsonobreadv.com.br/wp-includes/cryptted.ps1 https://universalmobility.pro/Striker.png https://safeifm.com/nabnoticesupportonline/bin.exe https://filedn.com/lEr8X39QyI3Ff9hN9vGodiR/env.zip https://pulgarinrealtor.com/ord/crypted.ps1 https://pulgarinrealtor.com/logo/crypted.ps1 https://meissner.ae/wp-includes/rest-api/XX64bin.exe https://vc.tnygbw.com/bin/stego_1lwwbg2gvn.png https://idylliccreations.net/gsew/crypted.ps1 https://impectorinternational.com/harder/binikuku.dat http://193.104.58.65/binyu.exe https://meissner.ae/wp-includes/rest-api/X64bin.exe https://click.vectorlabs.com/wp-content/bin.exe http://195.177.94.139/Xloadfile/bin.exe https://pulgarinrealtor.com/crypted.ps1 http://178.16.53.176/PW/prcrypted.ps1 https://somostask.co/Candy.png https://wylkpznq.xyz/hukl/cp/bin.exe https://flooriscoveringworld.com/bin.exe https://somostask.co/stego_2pu3tp48pp.png https://nieuw.technoberg.nl//wp-content/bin44.exe https://teakivo.com//wp-content/bin.exe https://alahlam.sa/wp-includes/sitemaps/uscnvym/c1vhrea/p1mujne/kk1crypted.ps1 https://alahlam.sa/wp-includes/sitemaps/uscnvym/c1vhrea/p1mujne/mycrypted.ps1 https://alahlam.sa/wp-includes/sitemaps/uscnvym/c1vhrea/p1mujne/21crypted.ps1 https://alahlam.sa/wp-includes/sitemaps/uscnvym/c1vhrea/p1mujne/KMcrypted.ps1 https://www.mixierealty.com/wp-content/bin.exe https://glbeletronica.com.br/wp-content/admin/bin.exe https://my-buck01.s3.cubbit.eu/A/am11binupload.txt https://glbeletronica.com.br/wp-content/admin/bin44.exe https://malaysianpastrybakery.org/crypted1.ps1 https://mnurlogistics.az/ind8inc/crypted.ps1 https://drive.google.com/uc?export=download&id=1QchDs5jxVrNvFZZwTe-lhTxkqAZ4dqNo http://178.16.53.176/DV/ojkcrypted.ps1 https://orienttaxtile.com/ttues/crypted.ps1 https://alphalkenya.com/VSooNlFLuZpdMiw.exe https://orienttaxtile.com/tuess/crypted.ps1 https://signageinsignia.co.za/kizzy/1.jpg http://178.16.53.176/DV/ojscrypted.ps1 http://178.16.53.176/HTTP/kcrypted.ps1 https://durakutihs.com/.well-known/acme-challenge/sma.exe http://216.9.224.48/xz/bin%20(2)upload%20(1).txt https://golvteametvarberg.se/wp-content/admin/bin.exe https://sweet-snowflake-8a7e.uploadesclintesss.workers.dev/sdXBP https://sales.ifree.page/img_131252.png https://cashblaq.fit/bin.exe http://217.60.241.35/crypted.ps1 https://hjha.ao/file/bin.dat https://sweet-snowflake-8a7e.uploadesclintesss.workers.dev/znIcB https://simplejack.lovestoblog.com/img_231339.png http://107.173.62.98/12345/crypted.ps1 https://drive.google.com/uc?export=download&id=1lWriYvaLQHR4VbRAJyyukuXtocZJbdOQ https://ufavalkplus.com/wp-admin/bin.exe https://malaysianpastrybakery.org/teamm.ps1 https://customcreationsmaine.com/db22/bin.exe https://drive.google.com/uc?export=download&id=1uP6eeZrFYoO4FDTkMKWOHntx-Hx7ULJj https://drive.google.com/uc?export=download&id=1rG8PN8efU6NPnWc2RyoyuL9wtjMo4Uz_ https://kgbhost.digital/kingboss/uploads/bin.exe
Source: URLhaus (abuse.ch). Updated: 2026-10-04
Hosting Infrastructure
| Host | URLs |
|---|---|
| drive.google.com | 19 |
| 158.94.210.129 | 10 |
| firebasestorage.googleapis.com | 5 |
| katz.adv.br | 5 |
| reinigung-kosanke.de | 4 |
| 178.16.53.176 | 4 |
| alahlam.sa | 4 |
| comserlivuior.store | 4 |
| 107.173.9.85 | 4 |
| github.com | 4 |
| hjha.ao | 3 |
| surun.info | 3 |
| 216.9.224.48 | 3 |
| productoslili.cl | 3 |
| pulgarinrealtor.com | 3 |
| mail.avicennaalliedhealthinstitute.org | 3 |
| pastefy.app | 3 |
| gateway.lighthouse.storage | 3 |
| 87130921-60-20220830152356.webstarterz.com | 2 |
| 107.173.227.126 | 2 |