IndicatorPublished 10 Jan 2026Updated 11 Jan 2026

ThreatFox IOCs for 2026-01-10

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 53

relay.trankor.onlineUnknown RAT botnet C2 domain (confidence level: 100%)
mintyfang2026.cyouUnknown Stealer botnet C2 domain (confidence level: 100%)
export.galmabuna.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
fnlipr.ru.comAsyncRAT botnet C2 domain (confidence level: 75%)
docs.exitdriving.schoolFAKEUPDATES botnet C2 domain (confidence level: 100%)
fish-needed.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
ziplocker.duckdns.orgQuasar RAT botnet C2 domain (confidence level: 100%)
commerce-ciao.infoUnknown RAT botnet C2 domain (confidence level: 100%)
dijora.za.comAsyncRAT botnet C2 domain (confidence level: 75%)
sagedigix.in.netAsyncRAT botnet C2 domain (confidence level: 75%)

URLs 58

https://rcmceberio.net/Unknown malware payload delivery URL (confidence level: 90%)
https://phambilihighschool.co.za/Unknown malware payload delivery URL (confidence level: 90%)
http://154.201.65.97:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://138.226.237.121/Vidar botnet C2 (confidence level: 100%)
https://18.202.117.177/Unknown malware payload delivery URL (confidence level: 90%)
https://cdn.jsdelivr.net/gh/identity-hub-rs-com/tkn-mgr0280/ino5fClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/identity-hub-rs-com/route-s215/opal50ClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/identity-hub-rs-com/route-s215/bmnClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/identity-hub-rs-com/route-s215/foootClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/identity-hub-rs-com/svc457-api357-metadata-regist8/ghhhhdhhhClearFake payload delivery URL (confidence level: 100%)

IP addresses 107

158.94.210.26Unknown RAT botnet C2 server (confidence level: 100%)
173.46.80.235Unknown RAT botnet C2 server (confidence level: 100%)
178.16.53.98Remcos botnet C2 server (confidence level: 100%)
91.224.92.144Remcos botnet C2 server (confidence level: 100%)
179.43.177.132Sliver botnet C2 server (confidence level: 100%)
185.208.159.209AsyncRAT botnet C2 server (confidence level: 100%)
45.153.34.79SectopRAT botnet C2 server (confidence level: 100%)
172.173.139.150Havoc botnet C2 server (confidence level: 100%)
3.84.109.1Meterpreter botnet C2 server (confidence level: 100%)
3.91.192.228Meterpreter botnet C2 server (confidence level: 100%)

Hashes 207

cdb58d3f8f521dab1ccf54c9370048f766e5fa8cDCRat payload (confidence level: 95%)
f72cb82b62fc929d3f9378fc266662ccbc660db1a34eebf755a3df7e5e62fc83DCRat payload (confidence level: 95%)
e6d1bdd511538f7d43616d9ce5e4d9f3DCRat payload (confidence level: 95%)
18ffdd34c14cb9f4a4a3702bc250d0e1fb7a23e1Owlproxy payload (confidence level: 95%)
49d3deb1a576e06636623dd17621335880d560206658326f60f99c715850e17eOwlproxy payload (confidence level: 95%)
066e5b41aa01b8cfcf36e6e2551af6afOwlproxy payload (confidence level: 95%)
0659cdfca6be91525e06b05248d0a67ef209e08fNimGrabber payload (confidence level: 95%)
6e9ccfe6dd2cdec470365a1723dc467d00c2aff0f333568b1004375bdda49b81NimGrabber payload (confidence level: 95%)
36e6f46cc4d2de89baf3764e58c40de8NimGrabber payload (confidence level: 95%)
cf16b32b7282fc4ec565945f8043d70776058730AsyncRAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-01-10

Impact

For European organizations, the impact of this threat is currently limited due to the absence of known exploits and specific affected systems. However, the involvement of OSINT and network activity suggests potential reconnaissance and targeted payload delivery attempts that could lead to data exfiltration or system compromise if exploited. Organizations heavily reliant on open-source intelligence for operations or those with exposed network services might face increased risk. The medium severity rating implies that while immediate damage is unlikely, the threat could evolve or be leveraged in multi-stage attacks. Disruption to confidentiality or integrity is possible if payload delivery succeeds, but availability impact appears minimal at this stage. The lack of patches and known exploits indicates that the threat may be more about information gathering or preparatory stages rather than active exploitation. European entities in sectors such as government, defense, and critical infrastructure should be particularly cautious given their strategic importance and frequent targeting by OSINT-driven campaigns.

Defensive guidance

European organizations should enhance their OSINT monitoring capabilities to detect suspicious activities related to this threat. Implement advanced network traffic analysis tools to identify unusual payload delivery attempts or anomalous network behavior. Employ threat intelligence sharing platforms to stay updated on emerging IOCs and threat actor tactics. Conduct regular security awareness training focused on recognizing social engineering and payload delivery methods. Segment networks to limit lateral movement in case of compromise. Utilize endpoint detection and response (EDR) solutions to identify and contain potential malware execution. Since no patches are available, focus on hardening network defenses, applying strict access controls, and maintaining up-to-date security configurations. Engage in proactive threat hunting exercises targeting OSINT-related indicators. Collaborate with European cybersecurity agencies to receive timely alerts and guidance. Finally, prepare incident response plans tailored to OSINT-driven threats and payload delivery scenarios.

Community reviews

Loading reviews…