IndicatorPublished 15 Jan 2026Updated 16 Jan 2026

ThreatFox IOCs for 2026-01-15

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 88

storehouse.beautysupplysalonllc.comFAKEUPDATES payload delivery domain (confidence level: 100%)
getinvolved.bukrilegacyfoundation.orgFAKEUPDATES botnet C2 domain (confidence level: 100%)
baretteexpressions.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
qirtewd.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
cruel.boatsCobalt Strike botnet C2 domain (confidence level: 75%)
batandball.in.netUnknown malware payload delivery domain (confidence level: 75%)
wwwyandex.orgRemcos botnet C2 domain (confidence level: 75%)
xiaocaifeng.netValleyRAT botnet C2 domain (confidence level: 100%)
toothpastesense.xyzUnknown Loader botnet C2 domain (confidence level: 100%)
powersmoke.xyzUnknown Loader botnet C2 domain (confidence level: 100%)

URLs 36

http://103.233.8.46:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://47.79.252.239:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://baretteexpressions.com/d.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://qirtewd.com/logout/secure-util.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://qirtewd.com/logout/redirect-response.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://qirtewd.com/logout/dashboard-hook.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://89.46.38.118/lannyNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://paikailai.com/lannyNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://89.46.38.118/authNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://for.erom-e.com/Vidar botnet C2 (confidence level: 100%)

IP addresses 255

65.108.68.112Unknown malware botnet C2 server (confidence level: 100%)
174.138.181.162Unknown malware botnet C2 server (confidence level: 100%)
185.91.127.94Unknown malware botnet C2 server (confidence level: 100%)
176.9.145.137Unknown malware botnet C2 server (confidence level: 100%)
185.91.127.32Unknown malware botnet C2 server (confidence level: 100%)
193.141.60.73Unknown malware botnet C2 server (confidence level: 100%)
185.91.127.91Unknown malware botnet C2 server (confidence level: 100%)
74.119.149.33Unknown malware botnet C2 server (confidence level: 100%)
205.209.117.202Unknown malware botnet C2 server (confidence level: 100%)
207.174.105.104Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-15

Impact

For European organizations, the impact of this threat is primarily related to enhanced detection and situational awareness rather than immediate compromise. Since no specific vulnerabilities or exploits are identified, the risk lies in potential malware campaigns that could leverage these IOCs for network intrusion or payload delivery. Organizations that fail to incorporate these IOCs into their detection systems may miss early signs of intrusion attempts. The medium severity suggests a moderate risk of operational disruption or data compromise if related malware campaigns succeed. Critical infrastructure and sectors with high exposure to cyber threats, such as finance, energy, and government, could face targeted attempts using these indicators. However, the lack of known exploits in the wild reduces the urgency of immediate defensive action beyond monitoring. The intelligence can help reduce dwell time and improve incident response effectiveness if integrated promptly.

Defensive guidance

European organizations should prioritize the integration of these IOCs into their existing security monitoring and threat intelligence platforms, such as SIEMs and endpoint detection and response (EDR) tools. Regularly updating threat intelligence feeds and correlating these IOCs with network traffic and endpoint behavior can help detect early signs of malicious activity. Organizations should conduct threat hunting exercises using these indicators to identify potential compromises. Enhancing network segmentation and monitoring for unusual payload delivery patterns can reduce the risk of lateral movement. Since no patches are available, focus should be on detection, containment, and response capabilities. Sharing findings and updates with national Computer Security Incident Response Teams (CSIRTs) and European cybersecurity information sharing organizations (e.g., ENISA) will improve collective defense. Training SOC analysts to recognize the patterns associated with these IOCs will also improve response times. Finally, maintaining up-to-date backups and incident response plans ensures preparedness in case of successful intrusion.

Community reviews

Loading reviews…