IndicatorPublished 28 Jan 2026Updated 29 Jan 2026

ThreatFox IOCs for 2026-01-28

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 76

reberts.comKongTuke payload delivery domain (confidence level: 100%)
cpanel.mahfuzrealtor.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
account.quarklab.appUnknown malware botnet C2 domain (confidence level: 75%)
account.quarkdrainer.comUnknown malware botnet C2 domain (confidence level: 75%)
peg.bexca.orgVidar payload delivery domain (confidence level: 100%)
ultra4ktool.comStealc botnet C2 domain (confidence level: 100%)
ferrimania.comSmartApeSG payload delivery domain (confidence level: 100%)
cole.zoomwork.oneUnknown RAT botnet C2 domain (confidence level: 100%)
solowheel.uk.comAsyncRAT botnet C2 domain (confidence level: 75%)
ufpi.br.comAsyncRAT botnet C2 domain (confidence level: 75%)

URLs 49

https://reberts.com/6h3d.jsKongTuke payload delivery URL (confidence level: 100%)
https://reberts.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
https://steamcommunity.com/profiles/76561198747567141Vidar payload delivery URL (confidence level: 100%)
https://peg.bexca.orgVidar botnet C2 (confidence level: 100%)
https://imeta-bypass-check.t3.storage.dev/verify-to-continue-id-jj-260125.htmlUnknown malware payload delivery URL (confidence level: 90%)
https://ferrimania.com/user/profile-controller.phpSmartApeSG payload delivery URL (confidence level: 100%)
https://ferrimania.com/user/profile-request.jsSmartApeSG payload delivery URL (confidence level: 100%)
http://185.81.114.153/loopSmartApeSG payload delivery URL (confidence level: 100%)
https://titanmonsterio.com/loopSmartApeSG payload delivery URL (confidence level: 100%)
https://185.81.114.153/portSmartApeSG payload delivery URL (confidence level: 100%)

IP addresses 214

144.31.215.26Mirai botnet C2 server (confidence level: 100%)
197.134.122.129Quasar RAT botnet C2 server (confidence level: 100%)
34.228.159.232Meterpreter botnet C2 server (confidence level: 100%)
54.206.83.53Meterpreter botnet C2 server (confidence level: 100%)
15.228.235.185Meterpreter botnet C2 server (confidence level: 100%)
57.180.249.131Meterpreter botnet C2 server (confidence level: 100%)
18.61.74.177Meterpreter botnet C2 server (confidence level: 100%)
43.201.50.138Meterpreter botnet C2 server (confidence level: 100%)
54.242.169.178Meterpreter botnet C2 server (confidence level: 100%)
54.242.169.178Meterpreter botnet C2 server (confidence level: 100%)

Hashes 245

4e7434ac13001fe55474573aa5e9379dBQTlock payload (confidence level: 100%)
a065c2d25096957126b9739f95810a12BQTlock payload (confidence level: 100%)
03427263da43843baf7cfd85f305fc77BQTlock payload (confidence level: 100%)
1859f56847ccabc6581a56f55041955fBQTlock payload (confidence level: 100%)
e0080e35657caed78566384a2e7b1ef4BQTlock payload (confidence level: 100%)
d244b63e40aab7299d194c11bf060054BQTlock payload (confidence level: 100%)
7170292337a894ce9a58f5b2176dfefcBQTlock payload (confidence level: 100%)
9323fca75a86c75ffbdcc88ed8f35e5aBQTlock payload (confidence level: 100%)
7ff1a6efe00d7b78094d3eb1740f179cBQTlock payload (confidence level: 100%)
a6d91094a222da6576260abf52a07b79BQTlock payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-28

Impact

For European organizations, the impact of this threat intelligence update is indirect but valuable. It enhances situational awareness and supports proactive defense by providing updated IOCs that can be integrated into security monitoring tools such as SIEMs, IDS/IPS, and endpoint detection platforms. While no immediate exploitation or vulnerability is reported, failure to incorporate such intelligence could delay detection of emerging threats that use similar payload delivery or network activity patterns. Organizations heavily reliant on OSINT for threat hunting and incident response will benefit most. The medium severity suggests moderate risk; however, without active exploitation, the direct impact on confidentiality, integrity, or availability is minimal at this stage. Nonetheless, this intelligence can help prevent or mitigate future attacks if acted upon promptly. European entities in critical infrastructure, finance, and government sectors should prioritize integrating these IOCs to maintain robust defense postures.

Defensive guidance

1. Integrate the provided ThreatFox IOCs into existing security monitoring and detection systems, including SIEM, IDS/IPS, and endpoint protection platforms, to enhance visibility of potential malicious activity. 2. Conduct regular threat hunting exercises using these IOCs to identify any signs of compromise or suspicious network behavior within the environment. 3. Maintain updated OSINT feeds and threat intelligence sharing partnerships to receive timely updates and context around emerging threats. 4. Train security analysts to interpret and act upon OSINT-derived indicators effectively, ensuring rapid response capabilities. 5. Implement network segmentation and strict egress filtering to limit the impact of potential payload delivery attempts. 6. Continuously review and update incident response plans to incorporate new intelligence and adapt to evolving threat landscapes. 7. Since no patches are available, focus on detection and containment strategies rather than remediation of vulnerabilities. 8. Collaborate with national and European cybersecurity agencies to share findings and receive additional guidance tailored to regional threat environments.

Community reviews

Loading reviews…