IndicatorPublished 21 Jan 2026Updated 22 Jan 2026

ThreatFox IOCs for 2026-01-21

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 149

panel.kalygenesis.xyzUnknown Stealer botnet C2 domain (confidence level: 100%)
gl1g7tts-5500.euw.devtunnels.msAgent Tesla payload delivery domain (confidence level: 100%)
chl.ru.comAsyncRAT botnet C2 domain (confidence level: 75%)
dc2.sa.comAsyncRAT botnet C2 domain (confidence level: 75%)
nuestraboda.it.comAsyncRAT botnet C2 domain (confidence level: 75%)
tosifu.jp.netAsyncRAT botnet C2 domain (confidence level: 75%)
losespadadz.myftp.bizXWorm botnet C2 domain (confidence level: 100%)
us-neuroquiet.co.comAsyncRAT botnet C2 domain (confidence level: 100%)
atlretf7m.localto.netSpyNote botnet C2 domain (confidence level: 100%)
xxblessing2026now.duckdns.orgXWorm botnet C2 domain (confidence level: 75%)

URLs 42

https://cdn.jsdelivr.net/gh/ws40-delta-xchg-fab8/23phys-step2-det-sim/asset-mgr11ClearFake payload delivery URL (confidence level: 100%)
https://mebelinki.ru/xamster.htmlUnknown malware payload delivery URL (confidence level: 90%)
https://kinugort.ru/xhamster.htmlUnknown malware payload delivery URL (confidence level: 90%)
http://astrologickeconoablos.cc:8080/updater?for=e0cd6a53d52a08539a9787e388ff1d3bUnknown malware botnet C2 (confidence level: 100%)
http://172.86.66.132Stealc botnet C2 (confidence level: 100%)
http://159.198.75.187Stealc botnet C2 (confidence level: 100%)
https://cdn.jsdelivr.net/gh/brush-tablet-win7/tg-sector-add/dareClearFake payload delivery URL (confidence level: 100%)
https://www.appleslicesllc.com/Unknown malware payload delivery URL (confidence level: 90%)
http://118.31.168.221:80/iqqrCobalt Strike botnet C2 (confidence level: 75%)
https://medhrrst.com/1h6f.jsKongTuke payload delivery URL (confidence level: 100%)

IP addresses 128

45.141.215.60Unknown Stealer botnet C2 server (confidence level: 100%)
109.172.91.23Remcos botnet C2 server (confidence level: 100%)
165.245.129.3Mirai botnet C2 server (confidence level: 80%)
138.124.79.35Stealc botnet C2 server (confidence level: 100%)
81.71.82.54Cobalt Strike botnet C2 server (confidence level: 100%)
198.23.177.214Remcos botnet C2 server (confidence level: 100%)
45.93.20.159Sliver botnet C2 server (confidence level: 100%)
105.157.55.3NetSupportManager RAT botnet C2 server (confidence level: 100%)
185.196.11.163Unknown malware botnet C2 server (confidence level: 100%)
206.189.39.125Meterpreter botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-21

Impact

The impact of this intelligence feed on European organizations is primarily indirect, serving as a resource for enhancing detection capabilities and situational awareness rather than indicating an immediate operational threat. Since no specific vulnerabilities or exploits are identified, the direct risk to confidentiality, integrity, or availability is low at this stage. However, the presence of malware-related IOCs and network activity indicators suggests that organizations should remain vigilant against potential payload delivery attempts or network intrusions. European entities that rely heavily on OSINT tools and network monitoring can leverage this intelligence to improve their threat hunting and incident response processes. Failure to incorporate such threat intelligence could result in delayed detection of emerging malware campaigns, potentially increasing exposure to subsequent attacks. The medium severity rating reflects the potential for these IOCs to be part of broader attack campaigns, emphasizing the importance of proactive monitoring and analysis.

Defensive guidance

1. Integrate the ThreatFox IOCs into existing Security Information and Event Management (SIEM) and threat intelligence platforms to enhance detection and correlation capabilities. 2. Regularly update intrusion detection and prevention system (IDS/IPS) signatures with the latest IOCs from ThreatFox and similar feeds. 3. Conduct proactive network traffic analysis focusing on payload delivery patterns and suspicious network activity aligned with the provided intelligence. 4. Enhance endpoint detection and response (EDR) tools to recognize behaviors associated with the malware types indicated by the feed. 5. Train security operations center (SOC) analysts to interpret and act upon OSINT-based threat intelligence effectively. 6. Establish automated workflows to ingest and operationalize threat intelligence feeds, reducing the time to detect and respond. 7. Collaborate with industry Information Sharing and Analysis Centers (ISACs) to contextualize the intelligence within sector-specific threat landscapes. 8. Perform regular threat hunting exercises using the IOCs to identify potential compromises early. 9. Maintain robust network segmentation and least privilege principles to limit the impact of potential payload delivery. 10. Ensure incident response plans include procedures for handling alerts generated from OSINT-based IOCs.

Community reviews

Loading reviews…