IndicatorPublished 29 Jan 2026Updated 30 Jan 2026

ThreatFox IOCs for 2026-01-29

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 58

th3hunt3r-53504.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
bek.cloudvaly.comVidar botnet C2 domain (confidence level: 100%)
bek.beznervov.comVidar botnet C2 domain (confidence level: 100%)
pov.cloudvaly.comVidar botnet C2 domain (confidence level: 100%)
pov.beznervov.comVidar botnet C2 domain (confidence level: 100%)
tor.cloudvaly.comVidar botnet C2 domain (confidence level: 100%)
tor.beznervov.comVidar botnet C2 domain (confidence level: 100%)
midlandaudio.comUnknown Stealer botnet C2 domain (confidence level: 100%)
kakapupuneww.comCastleRAT botnet C2 domain (confidence level: 100%)
evil.azuretest.frUnknown malware botnet C2 domain (confidence level: 100%)

URLs 37

https://34ten.com/Unknown malware payload delivery URL (confidence level: 90%)
https://cdn.jsdelivr.net/gh/relight-73-unsigned/tk-hz-ctrl/ypfcbjy5exc2pzs4bc7jClearFake payload delivery URL (confidence level: 100%)
http://144.172.106.251/Unknown malware botnet C2 (confidence level: 100%)
https://cdn.jsdelivr.net/gh/grading-chatter-dock73/super-docs-web3/sdfClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/grading-chatter-dock73/super-docs-web3/forwardClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/web3call/ws014/ethClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/web3call/ws014/cvxClearFake payload delivery URL (confidence level: 100%)
https://tor.cloudvaly.com/Vidar botnet C2 (confidence level: 100%)
https://tor.beznervov.com/Vidar botnet C2 (confidence level: 100%)
https://pov.cloudvaly.com/Vidar botnet C2 (confidence level: 100%)

IP addresses 118

81.94.151.189Mirai botnet C2 server (confidence level: 80%)
45.93.20.205Stealc botnet C2 server (confidence level: 100%)
138.226.236.254Stealc botnet C2 server (confidence level: 100%)
112.213.110.180Cobalt Strike botnet C2 server (confidence level: 100%)
72.60.30.120Sliver botnet C2 server (confidence level: 100%)
194.59.31.64Quasar RAT botnet C2 server (confidence level: 100%)
93.198.186.62NetSupportManager RAT botnet C2 server (confidence level: 100%)
83.136.251.141MimiKatz botnet C2 server (confidence level: 100%)
52.51.175.248Meterpreter botnet C2 server (confidence level: 100%)
38.60.214.166Cobalt Strike botnet C2 server (confidence level: 75%)

Description

ThreatFox IOCs for 2026-01-29

Impact

For European organizations, the impact of this threat is currently moderate due to the absence of active exploits and specific targeted vulnerabilities. However, the focus on network activity and payload delivery implies potential risks to network infrastructure and endpoint security if the malware is deployed successfully. Organizations relying heavily on networked services and digital communications could face disruptions or data compromise if these IOCs correspond to active campaigns. The lack of patches means that if exploitation vectors are discovered, remediation might be delayed, increasing exposure. The threat could also contribute to broader cyber espionage or data exfiltration efforts, especially in sectors with sensitive information such as finance, government, and critical infrastructure. The medium severity suggests that while immediate widespread damage is unlikely, the threat should not be ignored, particularly in environments with complex network architectures and high-value assets.

Defensive guidance

1. Integrate the provided IOCs into existing threat intelligence platforms and security information and event management (SIEM) systems to enhance detection capabilities. 2. Conduct network traffic analysis focusing on unusual payload delivery patterns or connections to suspicious domains or IPs associated with the IOCs. 3. Strengthen endpoint detection and response (EDR) tools to identify and quarantine potential malware payloads early in the attack chain. 4. Implement strict network segmentation to limit lateral movement if payload delivery occurs. 5. Maintain up-to-date backups and incident response plans tailored to malware infections involving network-based delivery. 6. Engage in active threat hunting exercises using the IOCs to identify potential compromises proactively. 7. Collaborate with national and European cybersecurity centers to share findings and receive updated intelligence. 8. Educate security teams on recognizing early signs of network-based payload delivery and OSINT-related reconnaissance activities. These steps go beyond generic advice by focusing on operationalizing the specific intelligence and enhancing detection and containment capabilities.

Community reviews

Loading reviews…