IndicatorPublished 19 Jan 2026Updated 20 Jan 2026

ThreatFox IOCs for 2026-01-19

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 35

onus.ru.comAsyncRAT botnet C2 domain (confidence level: 75%)
tr88.sa.comAsyncRAT botnet C2 domain (confidence level: 75%)
ultradatahost1.babyUnknown Stealer botnet C2 domain (confidence level: 100%)
visit.bombauthority.websiteUnknown Stealer botnet C2 domain (confidence level: 100%)
appolobase.comUnknown Stealer botnet C2 domain (confidence level: 100%)
smartprince111111Remcos botnet C2 domain (confidence level: 75%)
mythicserver.eastus.cloudapp.azure.comUnknown malware botnet C2 domain (confidence level: 100%)
fly88.gr.comAsyncRAT botnet C2 domain (confidence level: 75%)
xgpviv.za.comAsyncRAT botnet C2 domain (confidence level: 75%)
www.resrei.comAsyncRAT botnet C2 domain (confidence level: 75%)

URLs 40

http://etvidanueva.com/photos/images/webpanel/login.phpUnknown malware botnet C2 (confidence level: 100%)
https://51.79.204.217/Unknown malware payload delivery URL (confidence level: 90%)
https://cdn.jsdelivr.net/gh/strict-knoll-interface/ubiquitous-garbanzo/ba5eClearFake payload delivery URL (confidence level: 100%)
https://lom.make-lnk.com/sugqgzlavsjvmmrqUnknown malware payload delivery URL (confidence level: 90%)
https://socketapiupdates.com/kxq5q2ty_tc5x0obdjg2ohd6epotmm7i34pdnyszdldFAKEUPDATES payload delivery URL (confidence level: 100%)
https://steamcommunity.com/profiles/76561198747567141Vidar botnet C2 (confidence level: 100%)
https://telegram.me/skialt3Vidar botnet C2 (confidence level: 100%)
https://t.me/clepfortVidar botnet C2 (confidence level: 100%)
https://49.13.39.105/Vidar botnet C2 (confidence level: 100%)
https://116.203.0.214/Vidar botnet C2 (confidence level: 100%)

IP addresses 124

64.89.163.39Mirai botnet C2 server (confidence level: 80%)
45.93.20.199Stealc botnet C2 server (confidence level: 75%)
62.60.226.26Stealc botnet C2 server (confidence level: 75%)
69.5.189.243Stealc botnet C2 server (confidence level: 75%)
82.147.88.135Stealc botnet C2 server (confidence level: 75%)
86.54.25.34Stealc botnet C2 server (confidence level: 75%)
91.92.241.227Stealc botnet C2 server (confidence level: 75%)
91.92.242.93Stealc botnet C2 server (confidence level: 75%)
91.244.70.130Stealc botnet C2 server (confidence level: 75%)
103.101.85.56Stealc botnet C2 server (confidence level: 75%)

Description

ThreatFox IOCs for 2026-01-19

Impact

The impact of this threat intelligence update on European organizations depends largely on the relevance and accuracy of the IOCs to ongoing or emerging malicious campaigns. Since no direct exploit or vulnerability is described, the immediate risk is low to medium, primarily affecting detection and response capabilities. Organizations that integrate these IOCs into their security monitoring can potentially identify and mitigate malware infections or network intrusions earlier, reducing potential damage to confidentiality, integrity, and availability. Failure to incorporate such intelligence may result in delayed detection of threats that use similar indicators. The lack of known active exploits suggests that the threat is not currently causing widespread disruption, but the presence of payload delivery and network activity indicators implies a risk of malware infections if adversaries leverage these vectors. European entities with critical infrastructure, financial services, and government sectors stand to benefit most from timely threat intelligence to protect sensitive data and maintain operational continuity.

Defensive guidance

To effectively mitigate risks associated with the IOCs shared in this ThreatFox feed, European organizations should: 1) Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems and Endpoint Detection and Response (EDR) tools to enhance detection capabilities. 2) Regularly update threat intelligence feeds and correlate IOC data with internal logs to identify potential compromises early. 3) Conduct threat hunting exercises using these IOCs to proactively search for signs of malicious activity within networks. 4) Implement network segmentation and strict access controls to limit the spread of malware if detected. 5) Train security analysts to validate and contextualize IOCs to reduce false positives and improve incident response efficiency. 6) Share relevant findings with national and European cybersecurity information sharing organizations to strengthen collective defense. 7) Maintain up-to-date backups and incident response plans to minimize impact in case of successful payload delivery. These steps go beyond generic advice by emphasizing operational integration and collaboration.

Community reviews

Loading reviews…