IndicatorPublished 12 Jan 2026Updated 13 Jan 2026

ThreatFox IOCs for 2026-01-12

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 91

importhd.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
irregukw.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
mirelvse.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
reveiley.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
rumordoz.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
schemaqa.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
swimglii.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
triniliu.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
toki.e-konutbasvuruekran.sbsHavoc botnet C2 domain (confidence level: 100%)
www.mariseaverguyglobal.comRemcos botnet C2 domain (confidence level: 75%)

URLs 81

https://premiumdiagnostics.pk/Unknown malware payload delivery URL (confidence level: 90%)
https://animixplay.com.co/Unknown malware payload delivery URL (confidence level: 90%)
http://130.12.180.20:36695/c.shUnknown malware payload delivery URL (confidence level: 75%)
https://cdn.jsdelivr.net/gh/service28-discovery-registr/n4-g567-d8-af7/csvcClearFake payload delivery URL (confidence level: 100%)
https://miotech.be/Unknown malware payload delivery URL (confidence level: 90%)
https://cdn.jsdelivr.net/gh/browse-via-api/api-key-sash/logsClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/browse-fb-clock/urban-lamp-class/pullClearFake payload delivery URL (confidence level: 100%)
http://zapsnn.comAmadey botnet C2 (confidence level: 100%)
https://mirelvse.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
http://138.226.237.196Stealc botnet C2 (confidence level: 100%)

IP addresses 11,960

45.156.87.208Mirai botnet C2 server (confidence level: 80%)
223.26.62.209Cobalt Strike botnet C2 server (confidence level: 100%)
162.252.199.45SectopRAT botnet C2 server (confidence level: 100%)
192.227.152.84Bashlite botnet C2 server (confidence level: 100%)
18.191.154.93Empire Downloader botnet C2 server (confidence level: 100%)
173.255.203.221Empire Downloader botnet C2 server (confidence level: 100%)
176.65.132.175Stealc botnet C2 server (confidence level: 75%)
45.95.232.51Stealc botnet C2 server (confidence level: 75%)
45.151.91.164Stealc botnet C2 server (confidence level: 75%)
65.87.7.251Stealc botnet C2 server (confidence level: 75%)

Hashes 150

0e9daca1056706507aecf3bc4bbb0a46b1f50d23RedLine Stealer payload (confidence level: 95%)
34c7267370c91020590a49e861660c388fdd453e17d34849734295e02afefd1cRedLine Stealer payload (confidence level: 95%)
195dbe114df7a783dd938e8a2c208079RedLine Stealer payload (confidence level: 95%)
d076cf1d6dbf1c7d249e382161f504141105fd31Stealc payload (confidence level: 95%)
5cc5e2d2a89be652f7389dd7fe1d824b0f85c078e45f56ff70f8df5515500248Stealc payload (confidence level: 95%)
ad3ed83ab40eda76cbe850db2d8d3646Stealc payload (confidence level: 95%)
bfc9e74a0b587cfcd23b68f96a0ae60176292bd6Supper payload (confidence level: 95%)
1a4339229d831620e3b1413c9069a50949af84a332a0b705430a7a08f38837e5Supper payload (confidence level: 95%)
d29acd258044f14859ed18a1909d661eSupper payload (confidence level: 95%)
55664d490044180019905327c8b2bf9a39e4eebfStrelaStealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-01-12

Impact

For European organizations, the impact of this threat is currently moderate due to the lack of specific exploit details or confirmed active attacks. Potential impacts include unauthorized payload delivery that could lead to malware infection, data exfiltration, or disruption of services if the payloads are successfully executed. Organizations relying heavily on OSINT tools or engaged in cyber threat intelligence may be more exposed to reconnaissance activities or targeted payload delivery attempts. The absence of patches or known exploits suggests that the threat may be in reconnaissance or early distribution phases, limiting immediate damage but posing a risk if weaponized. Network infrastructure and security monitoring systems could be targeted to facilitate payload delivery or lateral movement. Confidentiality, integrity, and availability could be affected if payloads execute successfully, but the current information does not indicate widespread exploitation or critical vulnerabilities. European entities in sectors such as government, defense, and critical infrastructure, which are often targets of OSINT-driven campaigns, should be particularly cautious. Overall, the threat could lead to moderate operational disruption or data compromise if not detected and mitigated timely.

Defensive guidance

1. Integrate the latest ThreatFox IOCs into existing security information and event management (SIEM) and intrusion detection/prevention systems (IDS/IPS) to enhance detection capabilities. 2. Conduct focused network traffic analysis to identify unusual payload delivery patterns or suspicious OSINT-related reconnaissance activities. 3. Harden network perimeter defenses and apply strict egress filtering to limit unauthorized data exfiltration or command and control communications. 4. Employ threat hunting exercises targeting the identified IOCs and related network behaviors to uncover potential early-stage compromises. 5. Enhance user awareness and training regarding phishing and social engineering tactics that may accompany payload delivery. 6. Maintain up-to-date asset inventories and monitor for unauthorized changes or suspicious processes indicative of payload execution. 7. Collaborate with national and European cybersecurity centers to share intelligence and receive timely updates on emerging threats. 8. Implement network segmentation to contain potential infections and limit lateral movement. 9. Regularly review and update incident response plans to address OSINT-driven threat scenarios. 10. Since no patches are available, focus on detection and containment strategies rather than vulnerability remediation.

Community reviews

Loading reviews…