IndicatorPublished 9 Jan 2026Updated 10 Jan 2026

ThreatFox IOCs for 2026-01-09

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 154

mcafeeupdates.comShadowPad botnet C2 domain (confidence level: 95%)
frttsch.comKongTuke payload delivery domain (confidence level: 100%)
roadmap.lifeinsurancemasters.netFAKEUPDATES payload delivery domain (confidence level: 100%)
foresposition.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
mercedesheritage.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
farforshop.cfdAura Stealer botnet C2 domain (confidence level: 100%)
hhz.uk.comAsyncRAT botnet C2 domain (confidence level: 75%)
wey.uk.comAsyncRAT botnet C2 domain (confidence level: 75%)
bbb.flash-china.comCobalt Strike botnet C2 domain (confidence level: 75%)
zobyyog3nyah123-35769.portmap.hostXWorm botnet C2 domain (confidence level: 100%)

URLs 75

https://frttsch.com/2w2w.jsKongTuke payload delivery URL (confidence level: 100%)
https://frttsch.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
http://144.31.221.60/aKongTuke payload delivery URL (confidence level: 100%)
http://65.109.93.171:1476/update.shUnknown malware payload delivery URL (confidence level: 75%)
https://foresposition.com/profile/redirect-hook.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://foresposition.com/profile/profile-effect.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://foresposition.com/profile/router-request.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://89.46.38.5/restNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://buldiakogroup.com/restNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://89.46.38.5/soapNetSupportManager RAT payload delivery URL (confidence level: 100%)

IP addresses 6,655

45.148.101.24Stealc botnet C2 server (confidence level: 75%)
64.188.91.237Stealc botnet C2 server (confidence level: 75%)
91.208.162.22Stealc botnet C2 server (confidence level: 75%)
144.124.239.98Stealc botnet C2 server (confidence level: 75%)
150.241.65.134Stealc botnet C2 server (confidence level: 75%)
193.233.113.217Stealc botnet C2 server (confidence level: 75%)
194.33.61.22Stealc botnet C2 server (confidence level: 75%)
185.174.101.106Remcos botnet C2 server (confidence level: 100%)
46.224.114.83Sliver botnet C2 server (confidence level: 100%)
189.97.83.143Venom RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-09

Impact

For European organizations, the impact of this threat is primarily related to the potential for improved detection of malware-related network activity through the integration of these IOCs into security monitoring tools. Since no active exploits or vulnerabilities are identified, the immediate risk to confidentiality, integrity, or availability is low. However, failure to incorporate such OSINT-based IOCs could result in missed detection opportunities for malware payload delivery attempts. Organizations heavily reliant on network security monitoring and threat intelligence sharing stand to benefit most. The lack of patches or known exploits reduces urgency but underscores the need for continuous vigilance. The threat's medium severity suggests that while it is not an immediate crisis, it represents a meaningful component of the broader threat landscape that European entities should monitor to maintain robust cybersecurity postures.

Defensive guidance

European organizations should focus on integrating the provided ThreatFox IOCs into their existing security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection capabilities. Regularly updating threat intelligence feeds and correlating OSINT data with internal logs will improve early warning and response. Network traffic should be monitored for anomalies consistent with the described payload delivery and malware activity patterns. Since no patches are available, emphasis should be placed on proactive detection and containment strategies. Security teams should also participate in information sharing communities to stay informed of any updates or emerging threats related to these IOCs. Conducting regular threat hunting exercises using these indicators can help identify latent infections or reconnaissance activities. Finally, maintaining strong network segmentation and least privilege principles will limit potential lateral movement if malware is detected.

Community reviews

Loading reviews…