IndicatorPublished 18 Jan 2026Updated 19 Jan 2026

ThreatFox IOCs for 2026-01-18

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 52

webcloudplt2.oss-cn-shanghai.aliyuncs.comCobalt Strike botnet C2 domain (confidence level: 75%)
fljdslfjdsf-57814.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
matvey-41302.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
ou6161.comAsyncRAT botnet C2 domain (confidence level: 100%)
ou6262.comAsyncRAT botnet C2 domain (confidence level: 100%)
ou6363.comAsyncRAT botnet C2 domain (confidence level: 100%)
ba.za.comAsyncRAT botnet C2 domain (confidence level: 75%)
bfcg5.ru.comAsyncRAT botnet C2 domain (confidence level: 75%)
forums.uk.netAsyncRAT botnet C2 domain (confidence level: 75%)
haf.uk.comAsyncRAT botnet C2 domain (confidence level: 75%)

URLs 55

https://ownvitality.xsrv.jp/Unknown malware payload delivery URL (confidence level: 90%)
https://qualitylivingpm.com/Unknown malware payload delivery URL (confidence level: 90%)
https://polbath.co.uk/Unknown malware payload delivery URL (confidence level: 90%)
https://primaveraveiculos.com.imagineweb.dev.br/Unknown malware payload delivery URL (confidence level: 90%)
https://planocreativo.com/Unknown malware payload delivery URL (confidence level: 90%)
https://ramyjuicy-109c437.ingress-haven.ewp.live/Unknown malware payload delivery URL (confidence level: 90%)
https://residencialgolapa.com.br/Unknown malware payload delivery URL (confidence level: 90%)
https://pola-koko288.baby/Unknown malware payload delivery URL (confidence level: 90%)
https://private.kusherp.com/Unknown malware payload delivery URL (confidence level: 90%)
https://ppsac.com/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 99

138.124.108.212Stealc botnet C2 server (confidence level: 100%)
82.130.136.50Unknown malware botnet C2 server (confidence level: 100%)
103.79.79.105pupy botnet C2 server (confidence level: 100%)
217.216.48.9AsyncRAT botnet C2 server (confidence level: 100%)
54.204.117.176Nimplant botnet C2 server (confidence level: 100%)
139.177.205.92Empire Downloader botnet C2 server (confidence level: 100%)
193.161.193.99NjRAT botnet C2 server (confidence level: 100%)
213.176.73.149Stealc botnet C2 server (confidence level: 100%)
56.124.34.57Sliver botnet C2 server (confidence level: 100%)
95.9.236.229AsyncRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-18

Impact

For European organizations, the impact of this threat is primarily related to the potential for malware delivery and network-based compromise if the indicators are relevant to their environments. Although no active exploits or specific vulnerabilities are identified, the presence of new IOCs can help attackers evade detection if organizations do not update their threat intelligence and monitoring tools accordingly. Failure to incorporate these IOCs into security controls could lead to delayed detection of malware infections, resulting in data breaches, operational disruption, or lateral movement within networks. The medium severity suggests that while the threat is not immediately critical, it warrants attention to prevent escalation. Organizations in sectors with high exposure to malware campaigns, such as finance, critical infrastructure, and government, may face increased risk if they do not proactively integrate this intelligence. Additionally, the lack of patches means that defensive measures must focus on detection and response rather than remediation of a software flaw.

Defensive guidance

European organizations should integrate the provided IOCs into their existing security information and event management (SIEM) systems and endpoint detection and response (EDR) tools to enhance detection capabilities. Regularly updating threat intelligence feeds, including ThreatFox and MISP, is essential to maintain situational awareness. Network monitoring should be intensified to identify suspicious payload delivery attempts and anomalous network activity consistent with the indicators. Conducting threat hunting exercises using the new IOCs can help identify latent infections or ongoing attacks. Organizations should also ensure that their incident response teams are prepared to analyze and respond to malware infections promptly. Since no patches are available, emphasis should be placed on hardening network segmentation, enforcing least privilege access, and maintaining up-to-date backups to mitigate potential damage from malware infections. Employee awareness training on phishing and social engineering remains critical to reduce the risk of initial compromise via payload delivery.

Community reviews

Loading reviews…