IndicatorPublished 23 Jan 2026Updated 24 Jan 2026

ThreatFox IOCs for 2026-01-23

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 34

uekkek2424242442.dynuddns.netAsyncRAT botnet C2 domain (confidence level: 100%)
coordenacao2026.writesthisblog.comUnknown malware botnet C2 domain (confidence level: 100%)
bos.sodstreams.comVidar botnet C2 domain (confidence level: 100%)
bos.bexca.orgVidar botnet C2 domain (confidence level: 100%)
lat.sodstreams.comVidar botnet C2 domain (confidence level: 100%)
lat.bexca.orgVidar botnet C2 domain (confidence level: 100%)
akon.za.comQuasar RAT botnet C2 domain (confidence level: 75%)
gyp.uk.comQuasar RAT botnet C2 domain (confidence level: 75%)
katieqlhello.ru.comQuasar RAT botnet C2 domain (confidence level: 75%)
update.kernel-update.comCobalt Strike botnet C2 domain (confidence level: 100%)

URLs 74

https://trodatec.ch/Unknown malware payload delivery URL (confidence level: 90%)
http://195.178.136.19/1.exePhorpiex payload delivery URL (confidence level: 100%)
http://195.178.136.19/2.exePhorpiex payload delivery URL (confidence level: 100%)
http://195.178.136.19/3.exePhorpiex payload delivery URL (confidence level: 100%)
http://195.178.136.19/4.exePhorpiex payload delivery URL (confidence level: 100%)
http://195.178.136.19/5.exePhorpiex payload delivery URL (confidence level: 100%)
http://195.178.136.19/6.exePhorpiex payload delivery URL (confidence level: 100%)
http://195.178.136.19/7.exePhorpiex payload delivery URL (confidence level: 100%)
http://195.178.136.19/8.exePhorpiex payload delivery URL (confidence level: 100%)
http://195.178.136.19/9.exePhorpiex payload delivery URL (confidence level: 100%)

IP addresses 234

45.156.87.65Stealc botnet C2 server (confidence level: 100%)
94.103.1.30Stealc botnet C2 server (confidence level: 100%)
124.198.131.156Remcos botnet C2 server (confidence level: 100%)
155.94.144.226Sliver botnet C2 server (confidence level: 100%)
104.243.248.63AsyncRAT botnet C2 server (confidence level: 100%)
103.213.244.106MimiKatz botnet C2 server (confidence level: 100%)
103.213.244.104MimiKatz botnet C2 server (confidence level: 100%)
35.94.55.48Meterpreter botnet C2 server (confidence level: 100%)
52.215.72.24Meterpreter botnet C2 server (confidence level: 100%)
3.148.178.54Meterpreter botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-23

Impact

For European organizations, the impact of this threat is primarily in the realm of situational awareness and early warning. Since no active exploits or vulnerabilities are reported, the immediate risk to confidentiality, integrity, or availability is low to medium. However, failure to incorporate these IOCs into detection systems could result in delayed identification of malicious activity, potentially allowing attackers to establish footholds or deliver payloads undetected. Organizations with extensive network infrastructure and those involved in critical sectors such as finance, government, and telecommunications may face increased risk if they do not leverage this intelligence. The medium severity rating suggests that while the threat is not currently critical, it warrants attention to prevent escalation. The lack of patches or fixes means that mitigation relies on detection and response capabilities rather than remediation of software flaws.

Defensive guidance

European organizations should integrate the ThreatFox IOCs into their Security Information and Event Management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enhance detection capabilities. Regularly updating threat intelligence feeds and correlating these IOCs with internal logs can improve early identification of suspicious network activity. Network segmentation and strict egress filtering can limit the impact of potential payload delivery attempts. Conducting threat hunting exercises using these indicators can proactively identify compromised systems. Additionally, organizations should ensure that endpoint detection and response (EDR) tools are configured to alert on behaviors associated with the indicators. Training security operations center (SOC) analysts to recognize patterns related to OSINT-derived threats will improve response times. Finally, sharing intelligence with national and European cybersecurity centers can enhance collective defense.

Community reviews

Loading reviews…