IndicatorPublished 5 Jan 2026Updated 6 Jan 2026

ThreatFox IOCs for 2026-01-05

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 123

main.vetraproject.siteUnknown Stealer botnet C2 domain (confidence level: 100%)
globaleliteconsulting24.comUnknown malware botnet C2 domain (confidence level: 100%)
top.cloudpub.ruXWorm botnet C2 domain (confidence level: 100%)
xgspmgw8.liner5ag0.ruClearFake payload delivery domain (confidence level: 100%)
u9bygw3d.liner5ag0.ruClearFake payload delivery domain (confidence level: 100%)
3fj89h5i.dive9uoht2.ruClearFake payload delivery domain (confidence level: 100%)
1ulufjyr.dive9uoht2.ruClearFake payload delivery domain (confidence level: 100%)
1205eq5m.sunb2zealou5.ruClearFake payload delivery domain (confidence level: 100%)
41xyhih6.sunb2zealou5.ruClearFake payload delivery domain (confidence level: 100%)
9q0r8r20.m0ri5ompump.ruClearFake payload delivery domain (confidence level: 100%)

URLs 148

http://195.178.136.19/4Phorpiex payload delivery URL (confidence level: 100%)
https://44.200.11.23/Unknown malware payload delivery URL (confidence level: 90%)
https://sqlcapture.com/Unknown malware payload delivery URL (confidence level: 90%)
https://138.197.49.130:8081/Unknown malware payload delivery URL (confidence level: 90%)
http://85.192.28.115/ce369e7324834845.phpStealc botnet C2 (confidence level: 100%)
https://cuve-fioul-services.fr/Unknown malware payload delivery URL (confidence level: 90%)
http://195.178.136.19/5Phorpiex payload delivery URL (confidence level: 100%)
https://tesllamacapp.com/Unknown malware payload delivery URL (confidence level: 90%)
https://45.144.233.192/Unknown malware payload delivery URL (confidence level: 90%)
https://3.128.241.168/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 192

102.98.75.73NetSupportManager RAT botnet C2 server (confidence level: 100%)
84.154.181.89NetSupportManager RAT botnet C2 server (confidence level: 100%)
196.75.232.54Meterpreter botnet C2 server (confidence level: 100%)
3.128.241.168Unknown malware botnet C2 server (confidence level: 100%)
23.132.164.118PureLogs Stealer botnet C2 server (confidence level: 100%)
20.81.164.199Cobalt Strike botnet C2 server (confidence level: 75%)
77.90.3.52Cobalt Strike botnet C2 server (confidence level: 100%)
139.180.210.104Cobalt Strike botnet C2 server (confidence level: 100%)
172.233.1.83Cobalt Strike botnet C2 server (confidence level: 100%)
196.251.107.94AsyncRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-05

Impact

For European organizations, the impact of this threat is currently limited due to the absence of known exploits or active attacks. However, the presence of OSINT-related IOCs and payload delivery indicators suggests potential reconnaissance or early-stage intrusion attempts that could lead to more significant compromises if exploited. Organizations relying heavily on OSINT tools or those with extensive network infrastructures may face increased exposure to such reconnaissance activities. If threat actors use these IOCs to craft targeted attacks, confidentiality, integrity, and availability of systems could be at risk. The medium severity rating implies moderate risk, with potential for disruption or data leakage if payload delivery mechanisms succeed. The lack of patches or mitigation details means organizations must rely on proactive detection and response capabilities. European entities involved in critical infrastructure, finance, or government sectors should be particularly cautious, as these sectors are frequent targets for malware campaigns leveraging OSINT and network exploitation techniques.

Defensive guidance

European organizations should enhance their OSINT monitoring capabilities to detect and analyze emerging Indicators of Compromise related to this threat. Deploy advanced network traffic analysis tools capable of identifying unusual payload delivery patterns and suspicious network activity. Integrate threat intelligence feeds such as ThreatFox into Security Information and Event Management (SIEM) systems to automate detection and correlation of relevant IOCs. Conduct regular threat hunting exercises focusing on reconnaissance and early-stage intrusion indicators. Strengthen network segmentation and enforce strict access controls to limit lateral movement in case of initial compromise. Implement endpoint detection and response (EDR) solutions to identify and contain payload execution attempts. Maintain up-to-date incident response plans that incorporate OSINT-derived threat intelligence. Collaborate with national and European cybersecurity centers to share intelligence and best practices. Since no patches are available, focus on detection and containment rather than remediation of vulnerabilities. Finally, train security teams on interpreting OSINT data and integrating it into operational security workflows.

Community reviews

Loading reviews…