IndicatorPublished 27 Jan 2026Updated 28 Jan 2026

ThreatFox IOCs for 2026-01-27

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 37

modaaura.storeUnknown malware payload delivery domain (confidence level: 100%)
sporttip-partner.chHavoc botnet C2 domain (confidence level: 100%)
gotour.in.netAsyncRAT botnet C2 domain (confidence level: 75%)
humanmeat.us.comAsyncRAT botnet C2 domain (confidence level: 75%)
www.lootlify.chHavoc botnet C2 domain (confidence level: 100%)
www.officedirectorq.comRemcos botnet C2 domain (confidence level: 75%)
www.officedirectorqbackup.comRemcos botnet C2 domain (confidence level: 75%)
www.officedirectorqsecondbackup.comRemcos botnet C2 domain (confidence level: 75%)
lionsmanetech.shopStealc botnet C2 domain (confidence level: 100%)
niggerinmybuthole-56571.portmap.hostXWorm botnet C2 domain (confidence level: 100%)

URLs 28

https://modaaura.store/image.jpgUnknown malware payload delivery URL (confidence level: 100%)
http://ingov.myartsonline.com/login9875.phpUnknown malware botnet C2 (confidence level: 100%)
https://cdn.jsdelivr.net/gh/relight-73-unsigned/tk-hz-ctrl-70/4635461563546876ClearFake payload delivery URL (confidence level: 100%)
http://lionsmanetech.shop/1f66bbb8fea047c0.phpStealc botnet C2 (confidence level: 100%)
https://18.216.144.67/Unknown malware payload delivery URL (confidence level: 90%)
http://138.226.237.6Stealc botnet C2 (confidence level: 100%)
https://securelearn.co/Unknown malware payload delivery URL (confidence level: 90%)
https://192.177.26.249/Vidar botnet C2 (confidence level: 100%)
https://77.42.49.175/Vidar botnet C2 (confidence level: 100%)
https://83.228.229.110/Vidar botnet C2 (confidence level: 100%)

IP addresses 172

138.226.236.67Stealc botnet C2 server (confidence level: 100%)
87.106.143.220Mirai botnet C2 server (confidence level: 80%)
5.254.129.48Ghost RAT botnet C2 server (confidence level: 100%)
45.154.98.228Remcos botnet C2 server (confidence level: 100%)
85.17.146.235Remcos botnet C2 server (confidence level: 100%)
172.93.215.210Remcos botnet C2 server (confidence level: 100%)
110.42.62.76Unknown malware botnet C2 server (confidence level: 100%)
45.32.212.222Unknown malware botnet C2 server (confidence level: 100%)
102.98.103.60NetSupportManager RAT botnet C2 server (confidence level: 100%)
209.74.81.143Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-27

Impact

Given the lack of specific exploit details or affected software, the direct impact on European organizations is minimal at this stage. However, the presence of malware-related network activity and payload delivery IOCs in an OSINT feed suggests that threat actors may be active or preparing campaigns that could eventually target European entities. Organizations relying on threat intelligence for proactive defense may benefit from integrating these IOCs to enhance detection capabilities. The absence of patches or known exploits means no immediate remediation is required, but vigilance is warranted. Potential impacts could include increased risk of malware infections if these IOCs correspond to emerging threats not yet fully characterized. The medium severity implies moderate concern but no urgent crisis. European sectors with high exposure to cyber threats, such as finance, critical infrastructure, and government, should maintain awareness but are not currently at elevated risk from this specific feed update.

Defensive guidance

1. Integrate ThreatFox IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection of potential malware-related network activity. 2. Maintain updated threat intelligence feeds and correlate with internal logs to identify any matching indicators. 3. Conduct regular network traffic analysis focusing on unusual payload delivery patterns that may align with these IOCs. 4. Ensure robust network segmentation and least privilege principles to limit potential malware spread if infections occur. 5. Educate security teams to treat OSINT feed updates as early warning signals rather than immediate threats, avoiding unnecessary panic or resource diversion. 6. Continue patching and vulnerability management for all systems to reduce attack surface, even if no direct patches are indicated here. 7. Collaborate with national and European cybersecurity centers to share intelligence and contextualize emerging threats. These steps go beyond generic advice by emphasizing integration and contextual analysis of OSINT data rather than reactive patching or incident response.

Community reviews

Loading reviews…