IndicatorPublished 1 Jan 2026Updated 2 Jan 2026

ThreatFox IOCs for 2026-01-01

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 24

proton.eu.comAsyncRAT botnet C2 domain (confidence level: 100%)
indo-pak.us.comAsyncRAT botnet C2 domain (confidence level: 100%)
danhdeonline.co.comAsyncRAT botnet C2 domain (confidence level: 100%)
google.coppsindoor.orgUnknown malware botnet C2 domain (confidence level: 100%)
smartcloaker.sbsHook botnet C2 domain (confidence level: 100%)
vlxx.bzQuasar RAT botnet C2 domain (confidence level: 100%)
x.vlxx.bzQuasar RAT botnet C2 domain (confidence level: 100%)
windirautoupdates.topUnknown RAT botnet C2 domain (confidence level: 100%)
landerror.xyzUnknown Loader botnet C2 domain (confidence level: 100%)
momcherries.xyzUnknown Loader botnet C2 domain (confidence level: 100%)

URLs 6

http://62.60.226.159/SmokeLoader payload delivery URL (confidence level: 100%)
http://57.158.26.42:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://telegram.me/n0winyVidar botnet C2 (confidence level: 100%)
https://steamcommunity.com/profiles/76561198754432067Vidar botnet C2 (confidence level: 100%)
http://193.233.198.199/ca181e88d271449b.phpStealc botnet C2 (confidence level: 100%)
http://176.65.132.92/59d721647e414836.phpStealc botnet C2 (confidence level: 100%)

IP addresses 80

45.9.148.195Cobalt Strike botnet C2 server (confidence level: 100%)
47.83.149.23Cobalt Strike botnet C2 server (confidence level: 100%)
94.156.114.118Cobalt Strike botnet C2 server (confidence level: 100%)
18.190.122.198Unknown malware botnet C2 server (confidence level: 100%)
18.176.75.171Unknown malware botnet C2 server (confidence level: 100%)
69.164.207.137Unknown malware botnet C2 server (confidence level: 100%)
3.13.119.144Unknown malware botnet C2 server (confidence level: 100%)
3.13.119.144Unknown malware botnet C2 server (confidence level: 100%)
206.189.58.84Unknown malware botnet C2 server (confidence level: 100%)
196.251.100.51PureLogs Stealer botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-01

Impact

For European organizations, the impact of this threat is currently limited due to the lack of active exploitation and specific vulnerabilities. However, the presence of IOCs related to payload delivery and network activity indicates a potential for malware campaigns that could disrupt operations or lead to data compromise if leveraged effectively. Organizations relying heavily on OSINT tools or those with complex network infrastructures may face increased risk if attackers use these indicators to craft targeted attacks. The medium severity rating suggests a moderate risk to confidentiality, integrity, and availability, primarily through potential malware infections delivered via network vectors. The absence of patches and known exploits means organizations must rely on proactive detection and response rather than remediation of a known vulnerability. Failure to integrate such threat intelligence could result in delayed detection of malware campaigns, increasing the risk of operational disruption or data breaches.

Defensive guidance

European organizations should integrate the ThreatFox IOCs into their existing security information and event management (SIEM) systems and network monitoring tools to enhance detection capabilities. Regularly updating threat intelligence feeds and correlating them with network traffic can help identify suspicious payload delivery attempts early. Implement network segmentation and strict access controls to limit the spread of malware if an infection occurs. Conduct regular training for security teams on interpreting OSINT-based threat intelligence and applying it effectively. Employ advanced endpoint detection and response (EDR) solutions capable of recognizing behaviors associated with the provided IOCs. Since no patches are available, focus on strengthening perimeter defenses, including firewalls and intrusion detection/prevention systems (IDS/IPS), tuned to detect network activity patterns related to the threat. Additionally, perform routine threat hunting exercises using the IOCs to proactively identify potential compromises. Collaborate with national cybersecurity centers and information sharing organizations to stay updated on evolving threats related to this intelligence.

Community reviews

Loading reviews…