IndicatorPublished 25 Jan 2026Updated 26 Jan 2026

ThreatFox IOCs for 2026-01-25

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 46

genetichax.no-ip.bizDarkComet botnet C2 domain (confidence level: 100%)
poisonivy1.no-ip.orgDarkComet botnet C2 domain (confidence level: 100%)
kc15.no-ip.infoDarkComet botnet C2 domain (confidence level: 100%)
enemy1.no-ip.infoDarkComet botnet C2 domain (confidence level: 100%)
tcp-free.tunnel4.comDarkComet botnet C2 domain (confidence level: 100%)
nicedudesmoke.ddns.netDarkComet botnet C2 domain (confidence level: 100%)
botnet.nigassculo23.shopMirai botnet C2 domain (confidence level: 100%)
sumrak2026.duckdns.orgMirai botnet C2 domain (confidence level: 100%)
realityv3.redirectme.netMirai botnet C2 domain (confidence level: 100%)
dmss888.comValleyRAT botnet C2 domain (confidence level: 100%)

URLs 62

http://ldark.nm.ru/indBerbew botnet C2 (confidence level: 100%)
http://devx.nm.ru/indeBerbew botnet C2 (confidence level: 100%)
https://streamable.com/xf0twuDarkComet botnet C2 (confidence level: 100%)
https://cdn.jsdelivr.net/gh/step8-det-19-runtime/repl-88-rt-msh11/net-19-77-21ClearFake payload delivery URL (confidence level: 100%)
http://159.69.114.128/b5caa8f188054fc8.phpStealc botnet C2 (confidence level: 100%)
https://cdn.jsdelivr.net/gh/paper-skydiver-drv8/crispy-machine-band3/trans1atClearFake payload delivery URL (confidence level: 100%)
https://mail.smartbowls.co.za/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.qbb.nmi.mybluehost.me/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.mo-ag.co.uk/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.hostwala.in/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 381

87.120.191.59Mirai botnet C2 server (confidence level: 100%)
45.9.2.141Mirai botnet C2 server (confidence level: 80%)
139.162.20.230Mirai botnet C2 server (confidence level: 80%)
192.210.214.149Bashlite botnet C2 server (confidence level: 100%)
151.243.109.71Bashlite botnet C2 server (confidence level: 100%)
173.0.1.161DarkComet botnet C2 server (confidence level: 100%)
124.191.129.126DarkComet botnet C2 server (confidence level: 100%)
193.161.193.99SpyNote botnet C2 server (confidence level: 100%)
178.16.55.121SpyNote botnet C2 server (confidence level: 100%)
46.235.8.94SpyNote botnet C2 server (confidence level: 100%)

Hashes 152

5426419fbebd92814ed2536aeee47344447733d2Stealc payload (confidence level: 95%)
1d0bf84e6e273bafbdc0444952f3a9539b186e91d12c8e74353cb0a439bbb40bStealc payload (confidence level: 95%)
2877f3dcc58d4d42dc9f5220a0c910a2Stealc payload (confidence level: 95%)
d3744e977846e8fc4b02837397f564bc70b61282ValleyRAT payload (confidence level: 95%)
9b6c535f8f3bd6dfc649de5c8febb37d48f72ab86e36e2d5d6a035413f5a2e07ValleyRAT payload (confidence level: 95%)
97e2e03d1c0bd6adf254abffe3146f44ValleyRAT payload (confidence level: 95%)
72232bc762cefd130644f2252f252028b5251a9dMasad Stealer payload (confidence level: 95%)
c26fb8af789c11f5264a5beaeb521d56aeca04e2c1bdf792be73e6eb0596a0ebMasad Stealer payload (confidence level: 95%)
72b8eacdc04f767d3f6daa0e46a4f838Masad Stealer payload (confidence level: 95%)
3f88522674402060d87c5c5ba1c93ec9dfa9d497Remcos payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-01-25

Impact

For European organizations, this threat represents a moderate risk primarily through network-based malware payload delivery. Successful exploitation could lead to unauthorized access, data exfiltration, or disruption of services, impacting confidentiality, integrity, and availability. Sectors with critical infrastructure, such as energy, finance, and telecommunications, may face elevated risks due to their reliance on networked systems and the potential strategic value to threat actors. The lack of known exploits in the wild reduces immediate risk but does not eliminate the possibility of targeted or opportunistic attacks leveraging these IOCs. Organizations with insufficient network monitoring or outdated threat intelligence integration may be more vulnerable. The threat could also facilitate lateral movement within networks if initial payload delivery is successful, amplifying impact. Overall, the medium severity indicates a need for vigilance but not immediate crisis response.

Defensive guidance

1. Integrate the latest ThreatFox IOCs into existing security information and event management (SIEM) and intrusion detection/prevention systems (IDS/IPS) to enhance detection capabilities. 2. Conduct thorough network traffic analysis focusing on unusual payload delivery patterns or connections to suspicious domains or IP addresses identified in the IOCs. 3. Implement network segmentation to limit lateral movement in case of successful payload delivery. 4. Regularly update endpoint protection platforms with threat intelligence feeds to detect and block known malware payloads. 5. Employ anomaly detection techniques to identify deviations in network behavior indicative of payload delivery attempts. 6. Conduct targeted threat hunting exercises using the shared IOCs to proactively identify potential compromises. 7. Enhance employee awareness regarding phishing and social engineering, as these may be vectors for payload delivery despite no user interaction requirement noted. 8. Collaborate with national and European cybersecurity centers to share intelligence and receive updates on evolving threats. 9. Review and harden firewall and proxy configurations to restrict unauthorized outbound connections that malware might use for command and control. 10. Maintain an incident response plan that includes procedures for handling malware infections and network intrusions related to payload delivery.

Community reviews

Loading reviews…