IndicatorPublished 31 Jan 2026Updated 1 Feb 2026

ThreatFox IOCs for 2026-01-31

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 66

files.sandtagency.orgFAKEUPDATES botnet C2 domain (confidence level: 100%)
hsk-new.comDarkCloud Stealer botnet C2 domain (confidence level: 50%)
kapadocia.duckdns.orgMirai botnet C2 domain (confidence level: 100%)
img1.huorongsec.comCobalt Strike botnet C2 domain (confidence level: 75%)
dskzwf.za.comAsyncRAT botnet C2 domain (confidence level: 75%)
kzkxza.sa.comAsyncRAT botnet C2 domain (confidence level: 75%)
mfncnp.sa.comAsyncRAT botnet C2 domain (confidence level: 75%)
nbwkmp.sa.comAsyncRAT botnet C2 domain (confidence level: 75%)
romaniaprotv.in.netAsyncRAT botnet C2 domain (confidence level: 75%)
uxcpym.sa.comAsyncRAT botnet C2 domain (confidence level: 75%)

URLs 25

http://hsk-new.com/xdfwqsp/login.phpDarkCloud Stealer botnet C2 (confidence level: 100%)
https://cdn.jsdelivr.net/gh/relight-73-unsigned/ged13/nm12ClearFake payload delivery URL (confidence level: 100%)
https://cdn.jsdelivr.net/gh/www1day7/msdn/das3ClearFake payload delivery URL (confidence level: 100%)
http://104.238.177.164Stealc botnet C2 (confidence level: 75%)
https://45.93.20.141/Unknown malware payload delivery URL (confidence level: 90%)
http://23.94.61.153:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://138.226.237.76Stealc botnet C2 (confidence level: 100%)
http://45.88.91.156/pages/login.phpUnknown malware botnet C2 (confidence level: 100%)
https://casettalecese.it/wp-content/uploads/2022/10/hemigastrectomysdur.phpKoi Loader payload delivery URL (confidence level: 100%)
https://casettalecese.it/wp-content/uploads/2022/10/bivalviagrr.phpKoi Loader payload delivery URL (confidence level: 100%)

IP addresses 92

138.226.237.76Stealc botnet C2 server (confidence level: 100%)
198.23.175.59Remcos botnet C2 server (confidence level: 100%)
45.83.31.224Remcos botnet C2 server (confidence level: 100%)
5.61.208.94Remcos botnet C2 server (confidence level: 100%)
98.85.71.175Unknown malware botnet C2 server (confidence level: 100%)
79.241.98.68NetSupportManager RAT botnet C2 server (confidence level: 100%)
196.75.120.225Meterpreter botnet C2 server (confidence level: 100%)
196.221.166.170Meterpreter botnet C2 server (confidence level: 100%)
159.89.43.34Empire Downloader botnet C2 server (confidence level: 100%)
104.238.177.164Stealc botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-31

Impact

For European organizations, the impact of this threat is moderate due to its classification as OSINT-related malware with network activity and payload delivery components. If these IOCs correspond to active campaigns, organizations could face risks of data exfiltration, network intrusion, or malware infection. The absence of known exploits and patches suggests no immediate widespread compromise but highlights the need for vigilance. Potential impacts include disruption of network services, unauthorized access to sensitive information, and increased exposure to targeted attacks leveraging OSINT techniques. Organizations heavily reliant on networked infrastructure and those engaged in intelligence or research activities may be more vulnerable. The medium severity rating reflects a balanced risk profile where exploitation is possible but not trivial or widespread at this time.

Defensive guidance

1. Integrate the ThreatFox IOC feed into existing Security Information and Event Management (SIEM) and threat intelligence platforms to enable real-time detection of related indicators. 2. Enhance network monitoring to identify unusual payload delivery attempts, especially those leveraging OSINT tools or techniques. 3. Conduct regular threat hunting exercises focusing on network activity anomalies and payload delivery vectors. 4. Implement strict network segmentation to limit lateral movement in case of compromise. 5. Educate security teams on the latest OSINT-related malware tactics to improve incident response readiness. 6. Maintain up-to-date endpoint detection and response (EDR) solutions capable of identifying suspicious payloads. 7. Collaborate with national and European cybersecurity centers to share intelligence and coordinate defensive measures. 8. Since no patches are available, focus on detection and containment rather than remediation. 9. Review and harden firewall and intrusion detection/prevention system (IDS/IPS) rules to block known malicious network traffic patterns associated with these IOCs. 10. Regularly update and test incident response plans to handle potential malware infections stemming from these threat indicators.

Community reviews

Loading reviews…