IndicatorPublished 1 Feb 2026Updated 2 Feb 2026

ThreatFox IOCs for 2026-02-01

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 28

8l0nigjfnjuq3vnystisyg==XWorm botnet C2 domain (confidence level: 75%)
downloads.beaconvistamedical.comCobalt Strike botnet C2 domain (confidence level: 100%)
7z38l1pp.moduplaza.digitalClearFake payload delivery domain (confidence level: 100%)
ne4w2nbw.moduplaza.digitalClearFake payload delivery domain (confidence level: 100%)
www.scholze.familyHavoc botnet C2 domain (confidence level: 100%)
789club.za.comAsyncRAT botnet C2 domain (confidence level: 75%)
bajaban.sa.comAsyncRAT botnet C2 domain (confidence level: 75%)
kubetchuan.comAsyncRAT botnet C2 domain (confidence level: 75%)
vb0.za.comAsyncRAT botnet C2 domain (confidence level: 75%)
artabnewszamanpaper47.ru.comAsyncRAT botnet C2 domain (confidence level: 75%)

URLs 23

https://18.217.34.53/Unknown malware payload delivery URL (confidence level: 90%)
https://cdn.jsdelivr.net/gh/relight-73-unsigned/ged13/bb80ClearFake payload delivery URL (confidence level: 100%)
https://185.125.91.3/Unknown malware payload delivery URL (confidence level: 90%)
http://144.31.166.169/22f497205c838ab3.phpStealc botnet C2 (confidence level: 100%)
https://cdn.jsdelivr.net/gh/relight-73-unsigned/ged13/nm7ClearFake payload delivery URL (confidence level: 100%)
https://insomnia.top/api/upload_fast.phpUnknown malware botnet C2 (confidence level: 100%)
https://insomnia.top/api/c2_commands.phpUnknown malware botnet C2 (confidence level: 100%)
https://insomnia.top/api/c2_register.phpUnknown malware botnet C2 (confidence level: 100%)
http://zx.pe/bp.phpSpyBot botnet C2 (confidence level: 100%)
https://solidolbabrering.shopStealc botnet C2 (confidence level: 100%)

IP addresses 81

130.193.34.57Mirai botnet C2 server (confidence level: 80%)
195.178.136.38GCleaner botnet C2 server (confidence level: 100%)
181.214.100.216Sliver botnet C2 server (confidence level: 100%)
161.97.182.121Unknown malware botnet C2 server (confidence level: 100%)
13.135.251.41Meterpreter botnet C2 server (confidence level: 100%)
185.125.91.3Unknown malware botnet C2 server (confidence level: 100%)
185.125.91.3Unknown malware botnet C2 server (confidence level: 100%)
91.92.120.109PureLogs Stealer botnet C2 server (confidence level: 100%)
82.146.49.236Cobalt Strike botnet C2 server (confidence level: 100%)
102.204.223.168Unknown malware botnet C2 server (confidence level: 100%)

Hashes 180

3ff111f0659a076e47cd0caf48013e068459efd8StrelaStealer payload (confidence level: 95%)
6dfc959713cb5ff03a439ff2df42bb4868a3f3b00fd6aca29be21ad7ebf1afb7StrelaStealer payload (confidence level: 95%)
455743653d28556edc1da0874425dc4bStrelaStealer payload (confidence level: 95%)
cd61a4a9a5a7519128633ac27f44849dbbc15413Stealc payload (confidence level: 95%)
22d77061cbccb048adf52021775abc6a1af7eca93638b6043ad6f560b5e4d423Stealc payload (confidence level: 95%)
6a9c08da41d7f15291ad6dacc5b7a5c5Stealc payload (confidence level: 95%)
30aa9a92e8be58fdbf3b077d3fd3a6c8cbe890a0Amadey payload (confidence level: 95%)
1475a3bb4ec2d699b19fcc965c7a133dd253fa1e7aa1aed1eb85604315f34882Amadey payload (confidence level: 95%)
735af08a6a65e4efc3f6d2c70427c0e5Amadey payload (confidence level: 95%)
67bc6769efe16f31c310c17c954d4b1987263acbStealc payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-02-01

Impact

The potential impact of this threat on European organizations is currently limited due to the lack of specific exploit details or active campaigns. Since no known exploits or patches are associated, the immediate risk of compromise is low. However, the presence of network activity and payload delivery categories suggests that these IOCs could be indicators of malware campaigns or intrusion attempts that might target European networks. Organizations relying heavily on OSINT for threat detection may benefit from integrating these IOCs to enhance their monitoring capabilities. If leveraged by attackers, these indicators could facilitate reconnaissance or initial access phases in cyberattacks, potentially impacting confidentiality and availability if payloads are successfully delivered. The medium severity rating implies a moderate risk that requires attention but does not indicate an urgent or critical threat. Overall, the impact is more on the defensive posture and situational awareness rather than direct operational disruption at this time.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems and threat intelligence platforms to enhance detection capabilities. 2. Conduct regular network traffic analysis focusing on unusual payload delivery patterns or connections matching the threat intelligence. 3. Maintain updated endpoint detection and response (EDR) solutions to identify and isolate suspicious activities related to malware payloads. 4. Enhance employee awareness and training on recognizing phishing or social engineering attempts that could lead to payload delivery. 5. Collaborate with national and European cybersecurity centers to share and receive updated threat intelligence. 6. Implement network segmentation and strict access controls to limit the spread of potential malware infections. 7. Regularly review and update incident response plans to incorporate OSINT-derived intelligence for timely reaction. 8. Since no patches are available, focus on proactive detection and containment rather than remediation of vulnerabilities.

Community reviews

Loading reviews…