IndicatorPublished 11 Jan 2026Updated 12 Jan 2026

ThreatFox IOCs for 2026-01-11

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 61

newunveiled.comHavoc botnet C2 domain (confidence level: 100%)
eticaret.yonlendir.cfdHavoc botnet C2 domain (confidence level: 100%)
e-konutbasvuruekran.sbsHavoc botnet C2 domain (confidence level: 100%)
sosyalkonut.cfdHavoc botnet C2 domain (confidence level: 100%)
toki.sosyalkonutunuz.cfdHavoc botnet C2 domain (confidence level: 100%)
sosyalkonutprojesi.sbsHavoc botnet C2 domain (confidence level: 100%)
toki.konutbasvurutr.cfdHavoc botnet C2 domain (confidence level: 100%)
gd0.com.coUnknown malware botnet C2 domain (confidence level: 100%)
promole16.ddns.netUnknown RAT botnet C2 domain (confidence level: 100%)
rehumedece.ru.comAsyncRAT botnet C2 domain (confidence level: 75%)

URLs 29

https://iamdavidachom.com/tentrady-confirmation/Unknown malware payload delivery URL (confidence level: 90%)
https://cdn.jsdelivr.net/gh/token-issuer-svc/api80-1int-m35461/jhjfjjClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/token-issuer-svc/api80-1int-m35461/b12ClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/token-issuer-svc/s3/backClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/token-issuer-svc/s3/boomClearFake payload delivery URL (confidence level: 100%)
http://77.110.102.154/ce369e7324834845.phpStealc botnet C2 (confidence level: 100%)
https://cdn.jsdelivr.net/gh/id-core-rs-com/err2/localClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/token-id-4-api/api50-mint-ok/flClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/id-core-rs-com/power2/fastClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/browse-via-api/fb-api-keys/keysClearFake payload delivery URL (confidence level: 100%)

IP addresses 101

138.124.89.194Stealc botnet C2 server (confidence level: 100%)
107.189.24.255SectopRAT botnet C2 server (confidence level: 100%)
54.168.37.22Brute Ratel C4 botnet C2 server (confidence level: 100%)
182.254.168.212AdaptixC2 botnet C2 server (confidence level: 100%)
54.236.229.118Meterpreter botnet C2 server (confidence level: 100%)
54.236.229.118Meterpreter botnet C2 server (confidence level: 100%)
54.236.229.118Meterpreter botnet C2 server (confidence level: 100%)
54.236.229.118Meterpreter botnet C2 server (confidence level: 100%)
103.177.47.76Meterpreter botnet C2 server (confidence level: 100%)
199.101.111.34Meterpreter botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-11

Impact

For European organizations, the impact of this threat is currently limited due to the absence of known active exploits or specific affected systems. However, the focus on OSINT and network activity suggests potential reconnaissance or preparatory stages for more targeted attacks, which could lead to data exfiltration, unauthorized access, or disruption if followed by successful payload delivery. Organizations relying heavily on OSINT tools or with exposed network services might be more susceptible to reconnaissance activities that precede more severe attacks. The medium severity rating indicates a moderate risk that should not be ignored, especially for critical infrastructure, government entities, and sectors with high-value data. The lack of patches or direct mitigation measures means that defensive strategies must rely on detection, monitoring, and incident response readiness. If threat actors leverage these IOCs effectively, there could be an increased risk of intrusion attempts or malware deployment, impacting confidentiality, integrity, and availability of systems.

Defensive guidance

Given the nature of this threat intelligence update, European organizations should focus on enhancing their threat detection and monitoring capabilities. Specific recommendations include: 1) Integrate the provided IOCs into Security Information and Event Management (SIEM) systems and Endpoint Detection and Response (EDR) tools to identify potential malicious activity early. 2) Conduct regular network traffic analysis to detect unusual payload delivery attempts or reconnaissance behaviors. 3) Strengthen OSINT tool usage policies and monitor for suspicious queries or data access patterns. 4) Implement strict network segmentation and access controls to limit lateral movement if an intrusion occurs. 5) Maintain up-to-date threat intelligence feeds and collaborate with information sharing groups to stay informed about evolving threats. 6) Train security teams to recognize early indicators of compromise related to OSINT and network activity. 7) Prepare incident response plans that include scenarios involving payload delivery and network-based attacks. These measures go beyond generic advice by emphasizing proactive detection and operational readiness in the absence of direct patches or known exploits.

Community reviews

Loading reviews…