IndicatorPublished 20 Jan 2026Updated 21 Jan 2026

ThreatFox IOCs for 2026-01-20

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 55

qoz.uk.comAsyncRAT botnet C2 domain (confidence level: 75%)
cngov.cn.comAsyncRAT botnet C2 domain (confidence level: 75%)
fb888.in.netAsyncRAT botnet C2 domain (confidence level: 75%)
floorspace.uk.comAsyncRAT botnet C2 domain (confidence level: 75%)
shoe.eu.comAsyncRAT botnet C2 domain (confidence level: 75%)
www1.co.comAsyncRAT botnet C2 domain (confidence level: 75%)
uk3551.pickx.onlineRemcos botnet C2 domain (confidence level: 100%)
wc-ltc.myvnc.comQuasar RAT botnet C2 domain (confidence level: 100%)
wc-ltc.ddns.meQuasar RAT botnet C2 domain (confidence level: 100%)
oxygrapics.zapto.orgCyberGate botnet C2 domain (confidence level: 100%)

URLs 54

https://cdn.jsdelivr.net/gh/strict-knoll-interface/grave-filesystem-hd7/volumeClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/strict-knoll-interface/grave-filesystem-hd7/brampsClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/strict-knoll-interface/grave-filesystem-hd7/bucketClearFake payload delivery URL (confidence level: 100%)
http://110.40.198.62:5555/skmrCobalt Strike botnet C2 (confidence level: 75%)
https://cdn.jsdelivr.net/gh/service-reward-armory/friendly-posting-w1se/stand2ClearFake payload delivery URL (confidence level: 100%)
http://a1220157.xsph.ru/65cbae57.phpDCRat botnet C2 (confidence level: 100%)
http://robeson.queei.icu:443/jquery-3.3.1.min.jsCobalt Strike botnet C2 (confidence level: 75%)
http://simpson.speei.icu:443/jquery-3.3.1.min.jsCobalt Strike botnet C2 (confidence level: 75%)
https://wilknnson.com/6j6s.jsKongTuke payload delivery URL (confidence level: 100%)
https://wilknnson.com/js.phpKongTuke payload delivery URL (confidence level: 100%)

IP addresses 143

212.162.149.218Remcos botnet C2 server (confidence level: 100%)
45.86.162.133Unknown RAT botnet C2 server (confidence level: 100%)
45.86.162.133Unknown RAT botnet C2 server (confidence level: 100%)
130.162.44.203Sliver botnet C2 server (confidence level: 100%)
95.85.236.199SectopRAT botnet C2 server (confidence level: 100%)
108.187.4.218Venom RAT botnet C2 server (confidence level: 100%)
103.177.47.218Meterpreter botnet C2 server (confidence level: 100%)
8.219.82.235ValleyRAT botnet C2 server (confidence level: 100%)
46.246.86.11Vjw0rm botnet C2 server (confidence level: 100%)
8.219.185.117ValleyRAT botnet C2 server (confidence level: 100%)

Hashes 261

41d1728b33afc175d82b73eb6a2dcb92c66bb4ccValleyRAT payload (confidence level: 95%)
3da033579ce7eb25cc51e4fd9c7f060d110e29a5417fcb394734b9c4c89c6d2bValleyRAT payload (confidence level: 95%)
0634c78ea40ae9fc00ab3adf15f48bc0ValleyRAT payload (confidence level: 95%)
a9805b278880915f0d41cdb5464e8107952064d9DCRat payload (confidence level: 95%)
168590617d117480032f0760fd43c1aaf7bd33bb9d9e7542ef8411b196aea7f3DCRat payload (confidence level: 95%)
619f4629f0b4924680e92f5af3156138DCRat payload (confidence level: 95%)
59c490d6efe60c07a9c9887780930c4d93983364DCRat payload (confidence level: 95%)
dac6ceef5ed0906713c1f1b319ba7bf1e56a9aae6201c9f59bf97cbb94c787e0DCRat payload (confidence level: 95%)
722139ba13e0f38263b049baaa4cc42fDCRat payload (confidence level: 95%)
c496d36a7267a7f6b0aa134d179eb3c524ad0f7bMirai payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-01-20

Impact

For European organizations, the impact of this threat could manifest as unauthorized payload delivery leading to potential compromise of networked systems. Given the OSINT and network activity focus, organizations heavily reliant on open-source intelligence tools or those with exposed network services might be at increased risk. Potential impacts include data exfiltration, system disruption, or foothold establishment by threat actors. The absence of known exploits in the wild and patches suggests that the threat is either emerging or not widely exploited yet, reducing immediate risk but warranting vigilance. Critical infrastructure, government agencies, and sectors with high digital interconnectivity could face operational risks if payloads lead to malware execution. However, the medium severity rating and lack of detailed exploit mechanisms indicate that widespread or severe impact is currently unlikely without further threat evolution.

Defensive guidance

European organizations should implement enhanced network monitoring to detect unusual payload delivery or network activity associated with OSINT tools. Integration of threat intelligence feeds, including ThreatFox IOCs when available, into Security Information and Event Management (SIEM) systems can improve detection capabilities. Employ network segmentation to limit lateral movement if payload delivery occurs. Regularly update and harden OSINT tools and related software to minimize attack surface exposure. Conduct targeted threat hunting focusing on network traffic anomalies and payload signatures. Educate security teams on emerging OSINT-related threats and ensure incident response plans include scenarios involving network-based payload delivery. Since no patches are available, focus on detection and containment rather than remediation. Collaborate with European cybersecurity information sharing organizations to stay informed about evolving indicators and tactics related to this threat.

Summary

This threat entry from ThreatFox MISP Feed dated January 20, 2026, describes a malware-related threat primarily involving OSINT activities, network activity, and payload delivery. The data lacks specific affected software versions or detailed technical indicators, which limits the ability to pinpoint exact attack vectors or malware families involved. The threat is tagged as medium severity with no known exploits in the wild and no patches available, indicating either a newly identified or low-activity threat. The technical details show a moderate threat level (2 out of a possible higher scale), moderate analysis confidence (1), and a distribution score of 3, suggesting some degree of spread or detection across networks. The absence of CWEs and indicators implies that this is a generalized alert rather than a targeted vulnerability or exploit. The threat likely involves delivery of malicious payloads via network channels, potentially leveraging OSINT tools or data for reconnaissance or attack facilitation. The lack of authentication or user interaction details suggests the threat could be automated or passive in nature. Overall, this represents a medium-level malware threat emphasizing network-based payload delivery with limited actionable technical specifics.

Community reviews

Loading reviews…