IndicatorPublished 1 Mar 2026Updated 2 Mar 2026

ThreatFox IOCs for 2026-03-01

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 164

waygatterol002.comEtherRAT botnet C2 domain (confidence level: 75%)
o-parana.comEtherRAT botnet C2 domain (confidence level: 75%)
euclidrent.comEtherRAT botnet C2 domain (confidence level: 75%)
mebeliotmasiv.comEtherRAT botnet C2 domain (confidence level: 75%)
mietgarage-grossenwiehe.deStrelaStealer payload delivery domain (confidence level: 100%)
mifa.itStrelaStealer payload delivery domain (confidence level: 100%)
miftravelshop.maninflight.comStrelaStealer payload delivery domain (confidence level: 100%)
miguelangellopez.esStrelaStealer payload delivery domain (confidence level: 100%)
mijnbruiloft.wecapture.nlStrelaStealer payload delivery domain (confidence level: 100%)
mikadistributorspr.comStrelaStealer payload delivery domain (confidence level: 100%)

URLs 20

https://sos-ch-gva-2.exo.io/us5/verifying/cloudflare/index.html?o0czsjqdwiy6jonvwq0ot0et0nlrsy1etz-eetyqhwkpuan-oz4rwykkdn4iyk9hw5j-xsspzcrh8-%u%x-6npkr73hip3ncqll8e0cesh5rlkxsrr=tbregn=1vxm6eUnknown malware payload delivery URL (confidence level: 90%)
https://www.fundingfactors.com/Unknown malware payload delivery URL (confidence level: 90%)
https://catalogocanjefideliza.amsd.cl/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.castlefordlocksmiths.co.uk/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.kalantarilaw.com/Unknown malware payload delivery URL (confidence level: 90%)
https://coveney-ltd.com/Unknown malware payload delivery URL (confidence level: 90%)
https://ceymox.xyz/Unknown malware payload delivery URL (confidence level: 90%)
https://arayapps.cl/Unknown malware payload delivery URL (confidence level: 90%)
https://berlinphysiotherapie.com/Unknown malware payload delivery URL (confidence level: 90%)
https://customblindinstall.com/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 251

206.189.177.137Aisuru botnet C2 server (confidence level: 100%)
107.173.33.219Sliver botnet C2 server (confidence level: 100%)
118.107.47.86Quasar RAT botnet C2 server (confidence level: 100%)
168.245.203.22Meterpreter botnet C2 server (confidence level: 100%)
43.202.61.7Meterpreter botnet C2 server (confidence level: 100%)
196.65.221.137Meterpreter botnet C2 server (confidence level: 100%)
13.231.195.74Meterpreter botnet C2 server (confidence level: 100%)
103.23.255.74Empire Downloader botnet C2 server (confidence level: 100%)
23.226.48.201Cobalt Strike botnet C2 server (confidence level: 100%)
80.78.23.93Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-03-01

Impact

The potential impact of this threat intelligence feed is primarily in enhancing detection and response capabilities rather than indicating a direct, exploitable vulnerability. Organizations worldwide can leverage the IOCs to identify malicious payload delivery attempts and suspicious network activity, potentially reducing the risk of malware infections. However, since no specific exploits or vulnerabilities are detailed, the immediate risk of compromise is low to medium. The lack of patches or fixes means that mitigation relies on detection and prevention controls rather than remediation of a software flaw. If these IOCs correspond to active malware campaigns, organizations that do not integrate such intelligence into their security monitoring may face increased risk of undetected intrusions or data breaches. Overall, the impact is dependent on how effectively organizations incorporate this OSINT into their security operations rather than the threat itself causing direct harm.

Defensive guidance

To effectively mitigate risks associated with the intelligence provided by this ThreatFox feed, organizations should: 1) Integrate the IOCs into their Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection of payload delivery and network activity related to malware. 2) Regularly update threat intelligence sources and correlate with internal telemetry to identify emerging threats early. 3) Employ network segmentation and strict egress filtering to limit the impact of potential malware communications. 4) Conduct regular threat hunting exercises using the provided IOCs to proactively identify signs of compromise. 5) Maintain robust incident response plans that incorporate OSINT feeds for timely investigation and containment. 6) Educate security teams on interpreting and operationalizing OSINT data to improve response effectiveness. Since no patches are available, prevention and detection remain the primary defenses. Organizations should also ensure that endpoint and network security controls are up to date and configured to detect anomalous behavior consistent with payload delivery and network exploitation attempts.

Community reviews

Loading reviews…