IndicatorPublished 26 Jan 2026Updated 27 Jan 2026

ThreatFox IOCs for 2026-01-26

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 58

koky.hopto.orgXWorm botnet C2 domain (confidence level: 100%)
21.tcp.vip.cpolar.cnXWorm botnet C2 domain (confidence level: 100%)
verlyx12345-41388.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
pez.borendrokontho.comVidar botnet C2 domain (confidence level: 100%)
pez.lidiia.com.uaVidar botnet C2 domain (confidence level: 100%)
peg.borendrokontho.comVidar botnet C2 domain (confidence level: 100%)
peg.lidiia.com.uaVidar botnet C2 domain (confidence level: 100%)
fdy.borendrokontho.comVidar botnet C2 domain (confidence level: 100%)
fdy.lidiia.com.uaVidar botnet C2 domain (confidence level: 100%)
2vkube.ru.comQuasar RAT botnet C2 domain (confidence level: 75%)

URLs 58

http://45.227.253.59:3111/Unknown malware botnet C2 (confidence level: 100%)
https://cdn.jsdelivr.net/gh/untapped-showing-id-tid/how-upheld-gains/actClearFake payload delivery URL (confidence level: 100%)
https://fdy.borendrokontho.com/Vidar botnet C2 (confidence level: 100%)
https://fdy.lidiia.com.ua/Vidar botnet C2 (confidence level: 100%)
https://peg.borendrokontho.com/Vidar botnet C2 (confidence level: 100%)
https://peg.lidiia.com.ua/Vidar botnet C2 (confidence level: 100%)
https://pez.borendrokontho.com/Vidar botnet C2 (confidence level: 100%)
https://pez.lidiia.com.ua/Vidar botnet C2 (confidence level: 100%)
https://77.42.80.83/Vidar botnet C2 (confidence level: 100%)
https://65.109.241.53/Vidar botnet C2 (confidence level: 100%)

IP addresses 177

5.9.228.188Shadow RAT botnet C2 server (confidence level: 100%)
202.95.17.184Ghost RAT botnet C2 server (confidence level: 100%)
95.9.236.229AsyncRAT botnet C2 server (confidence level: 100%)
92.255.85.107SectopRAT botnet C2 server (confidence level: 100%)
149.28.179.135Unknown malware botnet C2 server (confidence level: 100%)
212.11.64.250MimiKatz botnet C2 server (confidence level: 100%)
13.245.164.240Meterpreter botnet C2 server (confidence level: 100%)
15.206.81.89Meterpreter botnet C2 server (confidence level: 100%)
3.35.50.24Meterpreter botnet C2 server (confidence level: 100%)
13.212.84.203Meterpreter botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-26

Impact

For European organizations, the impact of this threat is currently limited due to the lack of detailed indicators and absence of known active exploits. If the IOCs correspond to malware targeting network infrastructure or endpoints, organizations could face risks such as unauthorized access, data exfiltration, or service disruption. The medium severity rating suggests that while the threat is not negligible, it does not represent an immediate critical risk. The primary impact lies in the potential for early detection and prevention of malware campaigns that may leverage these IOCs. Organizations relying heavily on OSINT tools or those with extensive network exposure could be more susceptible if these indicators relate to targeted payload delivery. However, without specific affected products or vulnerabilities, the threat remains primarily informational, emphasizing the need for vigilance rather than urgent remediation.

Defensive guidance

European organizations should incorporate the provided IOCs into their threat intelligence platforms and security information and event management (SIEM) systems to enhance detection capabilities. Regularly updating intrusion detection and prevention systems (IDS/IPS) with the latest signatures derived from these IOCs is essential. Network traffic should be monitored for unusual payload delivery patterns or connections matching the threat intelligence. Organizations should also conduct threat hunting exercises using these IOCs to identify potential compromises early. Since no patches or fixes are available, emphasis should be placed on defense-in-depth strategies, including network segmentation, endpoint protection, and user awareness training. Collaboration with national cybersecurity centers and sharing updated threat intelligence can improve collective defense. Finally, maintaining robust incident response plans will help mitigate any potential impact if these IOCs correspond to active malware campaigns.

Community reviews

Loading reviews…