IndicatorPublished 16 Jan 2026Updated 17 Jan 2026

ThreatFox IOCs for 2026-01-16

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 413

ebultras.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
cpanel.diasporanexus.orgFAKEUPDATES botnet C2 domain (confidence level: 100%)
triplecust.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
buenisa.comNetSupportManager RAT botnet C2 domain (confidence level: 100%)
moredosk.comNetSupportManager RAT botnet C2 domain (confidence level: 100%)
menu.etetefusioncatering.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
agn121-46042.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
mohamed1231-31554.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
aliyundunupdate.xyzUnknown malware botnet C2 domain (confidence level: 100%)
mxx.sekershuk.comVidar botnet C2 domain (confidence level: 100%)

URLs 423

https://iplogger.co/1zrcl4Unknown Stealer botnet C2 (confidence level: 100%)
http://82.221.139.173:3712/bins/systemx64.arm5Unknown malware payload delivery URL (confidence level: 75%)
http://82.221.139.173:3712/bins/systemx64.arm6Unknown malware payload delivery URL (confidence level: 75%)
http://82.221.139.173:3712/bins/systemx64.arm7Unknown malware payload delivery URL (confidence level: 75%)
http://82.221.139.173:3712/bins/systemx64.m68kUnknown malware payload delivery URL (confidence level: 75%)
http://82.221.139.173:3712/bins/systemx64.spcUnknown malware payload delivery URL (confidence level: 75%)
http://82.221.139.173:3712/bins/systemx64.x86Unknown malware payload delivery URL (confidence level: 75%)
http://82.221.139.173:3712/bins/systemx64.x86_64Unknown malware payload delivery URL (confidence level: 75%)
http://82.221.139.173:3712/bins/systemx64.mipsUnknown malware payload delivery URL (confidence level: 75%)
http://82.221.139.173:3712/bins/systemx64.armUnknown malware payload delivery URL (confidence level: 75%)

IP addresses 265

49.13.36.175NetSupportManager RAT botnet C2 server (confidence level: 100%)
104.177.151.93Unknown malware botnet C2 server (confidence level: 75%)
149.30.248.18Unknown malware botnet C2 server (confidence level: 75%)
12.78.10.14Unknown malware botnet C2 server (confidence level: 75%)
88.87.15.67Unknown malware botnet C2 server (confidence level: 75%)
191.37.248.66Unknown malware botnet C2 server (confidence level: 75%)
103.226.25.200Unknown malware botnet C2 server (confidence level: 75%)
83.228.102.29Unknown malware botnet C2 server (confidence level: 75%)
46.55.156.109Unknown malware botnet C2 server (confidence level: 75%)
125.39.152.213Unknown malware botnet C2 server (confidence level: 75%)

Hashes 20

Unknown malware payload (confidence level: 75%)

d8fbe7bd2d399131611c9a57541e4444
9810bc6f3c8a0cfebf10aa1ac18a94fe
e0d83d943cb03dc982a9cceae3324575
9e80e5794cd8447e3bae73f8e43eb93a
91b64dea4d5b91b552af9af3e73b21e9
d66e63db75816f1612ee66e5ef80a1a1
0f85e1cc2090e3426eb24011c2bb4b98
79f3be41931e1e32559980fbe037862b
d52fa479098e9ca3d5f28191311f588c
4cadd3e503e79af2161d857f71e60d31

Description

ThreatFox IOCs for 2026-01-16

Impact

For European organizations, the potential impact of this threat depends largely on the nature of the malware payloads and delivery mechanisms, which are unspecified. However, given the medium severity and focus on network activity and payload delivery, there is a risk of unauthorized access, data exfiltration, or disruption of services if the malware is successfully deployed. Organizations relying heavily on OSINT for their threat intelligence may find this feed useful for early detection but must be cautious about incomplete data. The lack of known exploits reduces immediate risk, but the threat could evolve. Critical infrastructure, financial institutions, and government entities in Europe could face targeted attempts to leverage such malware for espionage or disruption. The indirect impact includes the potential for increased resource allocation to monitoring and incident response, as well as reputational damage if breaches occur.

Defensive guidance

Given the limited technical details, mitigation should focus on strengthening network security posture and threat intelligence capabilities. European organizations should: 1) Integrate ThreatFox and other OSINT feeds into their Security Information and Event Management (SIEM) systems to enhance detection capabilities. 2) Conduct regular network traffic analysis to identify anomalous payload delivery attempts. 3) Employ advanced endpoint detection and response (EDR) tools to detect and contain malware execution. 4) Maintain up-to-date security awareness training to reduce the risk of social engineering attacks that may accompany payload delivery. 5) Implement strict access controls and network segmentation to limit malware spread. 6) Collaborate with national and EU cybersecurity centers to share intelligence and receive timely alerts. 7) Prepare incident response plans tailored to malware infections involving network payload delivery. These steps go beyond generic advice by emphasizing integration of OSINT feeds and proactive network monitoring.

Community reviews

Loading reviews…