IndicatorPublished 14 Jan 2026Updated 15 Jan 2026

ThreatFox IOCs for 2026-01-14

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 42

flowerphase.inUnknown RAT botnet C2 domain (confidence level: 100%)
danocore.ddns.netQuasar RAT botnet C2 domain (confidence level: 75%)
bleededer-41468.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
rss-august.at.playit.ggNjRAT botnet C2 domain (confidence level: 100%)
xrx.erom-e.comVidar botnet C2 domain (confidence level: 100%)
xrx.zeronoiseclassroom.comVidar botnet C2 domain (confidence level: 100%)
newpappernews211.ru.comAsyncRAT botnet C2 domain (confidence level: 75%)
xhsq.sa.comAsyncRAT botnet C2 domain (confidence level: 75%)
dre.erom-e.comVidar botnet C2 domain (confidence level: 100%)
dre.zeronoiseclassroom.comVidar botnet C2 domain (confidence level: 100%)

URLs 67

http://185.132.53.174/maybe.exeSalatStealer payload delivery URL (confidence level: 100%)
https://www.sgardenchild.com/Unknown malware payload delivery URL (confidence level: 90%)
http://165.154.224.129:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://cdn.jsdelivr.net/gh/routing78-fabric43-euw3/csz54-hrt8-s43-g984-gsdf555/ruckusboxClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/browse-fb-clock/octo-carnival/bukketClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/clock-cheking/expert-barnacle/brandClearFake payload delivery URL (confidence level: 100%)
https://spectrumtechconsulting.com/Unknown malware payload delivery URL (confidence level: 90%)
https://sprueche-wuensche-gruesse.com/Unknown malware payload delivery URL (confidence level: 90%)
https://standart-uk.kz/Unknown malware payload delivery URL (confidence level: 90%)
https://totobi.top/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 150

41.216.188.162Mirai botnet C2 server (confidence level: 80%)
23.94.126.157PureRAT botnet C2 server (confidence level: 75%)
23.94.126.157PureRAT botnet C2 server (confidence level: 75%)
23.94.126.157PureRAT botnet C2 server (confidence level: 75%)
154.6.197.41Mirai botnet C2 server (confidence level: 80%)
144.124.251.175Stealc botnet C2 server (confidence level: 100%)
120.48.168.57Cobalt Strike botnet C2 server (confidence level: 100%)
54.180.141.230Cobalt Strike botnet C2 server (confidence level: 100%)
212.162.149.216Remcos botnet C2 server (confidence level: 100%)
198.23.177.222Remcos botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-14

Impact

For European organizations, the impact of this threat could manifest as unauthorized network intrusions, data exfiltration, or disruption of services due to malware payload delivery. Sectors with critical network infrastructure, such as finance, telecommunications, and government, may face increased risk if the malware payloads are designed to exploit network vulnerabilities or deliver ransomware or spyware. The lack of specific exploit details means the threat could be broad and opportunistic, potentially affecting any organization with exposed network services or insufficient monitoring. The medium severity suggests that while immediate catastrophic impact is unlikely, persistent infections or data breaches could occur if the threat is not detected early. Additionally, the absence of patches indicates that mitigation relies heavily on detection and response capabilities rather than vulnerability remediation. European organizations with mature cybersecurity frameworks may mitigate risks better, but those with less developed defenses could experience operational disruptions or data loss.

Defensive guidance

1. Integrate ThreatFox and other OSINT feeds into Security Information and Event Management (SIEM) systems to enhance detection of emerging IOCs related to malware payload delivery. 2. Implement advanced network monitoring solutions capable of identifying anomalous traffic patterns indicative of payload delivery or command-and-control communications. 3. Conduct regular threat hunting exercises focusing on network activity anomalies and suspicious payloads, even in the absence of known signatures. 4. Harden network perimeter defenses, including segmentation and strict access controls, to limit lateral movement if payload delivery occurs. 5. Employ endpoint detection and response (EDR) tools to identify and isolate malware infections promptly. 6. Maintain up-to-date incident response plans that incorporate OSINT-derived threat intelligence for rapid containment. 7. Educate security teams on interpreting OSINT data and integrating it into operational workflows to improve proactive defense. 8. Collaborate with national and European cybersecurity centers to share intelligence and coordinate responses to emerging threats. These measures go beyond generic advice by emphasizing the operational integration of OSINT data and proactive network behavior analysis.

Community reviews

Loading reviews…