IndicatorPublished 3 Mar 2026Updated 4 Mar 2026

ThreatFox IOCs for 2026-03-03

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 270

retrepoint.topSmartApeSG payload delivery domain (confidence level: 100%)
xpertlearninghub.comKongTuke payload delivery domain (confidence level: 100%)
customer.grovecityroofing.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
support.grovecityelectrician.comFAKEUPDATES payload delivery domain (confidence level: 100%)
cpanel.siefertfamilydentistry.comFAKEUPDATES payload delivery domain (confidence level: 100%)
klinklin.okonlomon.comRemcos botnet C2 domain (confidence level: 75%)
madeleinemcmichael.comStrelaStealer payload delivery domain (confidence level: 100%)
mincho.site.tb-hosting.comStrelaStealer payload delivery domain (confidence level: 100%)
milfs.xvideoclip.netStrelaStealer payload delivery domain (confidence level: 100%)
magazin.obbzor.topStrelaStealer payload delivery domain (confidence level: 100%)

URLs 40

https://ai-informer.net/?id=9228023&__cf_chl_rt_tk=0wtt341v83oftlu9_svt0mpcgs8eixguxrj0lgibmkt4-1759406441-1.0.1.1-ckgxnjenc3biln23wwtgd4zte00eybzdcxqqw55zkfccUnknown malware payload delivery URL (confidence level: 90%)
https://retrepoint.top/gateway/proxy-thread.jsSmartApeSG payload delivery URL (confidence level: 100%)
https://retrepoint.top/gateway/verify-service.phpSmartApeSG payload delivery URL (confidence level: 100%)
https://retrepoint.top/gateway/tenant-partial.jsSmartApeSG payload delivery URL (confidence level: 100%)
https://crexityous.com/pollSmartApeSG payload delivery URL (confidence level: 100%)
https://79.141.163.163/handleSmartApeSG payload delivery URL (confidence level: 100%)
https://zqmk9ymc1hx0kumrm0v5awvv.t3.storage.dev/verify-to-continue-id-rttpros-260301-4223.htmlUnknown malware payload delivery URL (confidence level: 90%)
https://xpertlearninghub.com/createKongTuke payload delivery URL (confidence level: 100%)
http://45.38.42.197:81/pages/login.phpUnknown malware botnet C2 (confidence level: 100%)
https://neletuchi.ru/xhamster.htmlUnknown malware payload delivery URL (confidence level: 90%)

IP addresses 389

58.74.6.14Mirai botnet C2 server (confidence level: 100%)
43.240.239.240Cobalt Strike botnet C2 server (confidence level: 100%)
156.234.56.34Cobalt Strike botnet C2 server (confidence level: 100%)
185.189.12.199Cobalt Strike botnet C2 server (confidence level: 100%)
47.107.139.30Cobalt Strike botnet C2 server (confidence level: 100%)
156.234.21.218Cobalt Strike botnet C2 server (confidence level: 100%)
150.241.73.11Cobalt Strike botnet C2 server (confidence level: 100%)
103.124.106.223Cobalt Strike botnet C2 server (confidence level: 100%)
31.57.216.45Remcos botnet C2 server (confidence level: 100%)
77.90.185.21Remcos botnet C2 server (confidence level: 100%)

Hashes 190

ee401ae9de8a50f3f0eab4810e49a1db94067f436daaeb9fe75e6de826ee7338Unknown Stealer payload (confidence level: 100%)
0ac9950d00429ff4509c7fb9aa7320a45a0465eaGUIDLOADER payload (confidence level: 95%)
dca40a0120ea176aa65b99c90d171761cb8bf696be4be026941f7f54e3c21635GUIDLOADER payload (confidence level: 95%)
5e364c1e35445b655ca30ab0c5bc7a4aGUIDLOADER payload (confidence level: 95%)
2f4c3365faf595cfb3215ec1cb97541a5d8279adSnojan payload (confidence level: 95%)
40b25e0433d882b8e6027565717fceebf73111b0c5aa22b6f8e90b15e516cbc8Snojan payload (confidence level: 95%)
2838d2fc55d455dbf1ec068673a8d6bcSnojan payload (confidence level: 95%)
4996e09de3fdd4ae47f72498924715590fce95b9Neconyd payload (confidence level: 95%)
ab8a2dea295d6d377736c9c1ad3a56f04025e8328e5dead19ccdf180fa20d5e9Neconyd payload (confidence level: 95%)
95f53f2681e9f9d8866c785a94202eb5Neconyd payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-03-03

Impact

The impact of this threat intelligence feed is indirect but important for organizations worldwide. By incorporating these IOCs into security monitoring and detection systems, organizations can improve their ability to identify and respond to potential malware infections or network intrusions early. While no active exploits or vulnerabilities are described, the intelligence can help prevent successful payload delivery and limit network activity associated with malicious actors. Failure to utilize such intelligence may result in delayed detection of threats, increasing the risk of data breaches, system compromise, or operational disruption. The medium severity rating reflects the moderate potential impact if these IOCs correspond to active or emerging threats. Organizations with mature cybersecurity programs that leverage OSINT and threat intelligence feeds will benefit most, as they can translate this data into actionable alerts and incident response. Conversely, organizations lacking threat intelligence integration may miss early warning signs, increasing exposure to malware campaigns. Overall, the impact is on enhancing detection and prevention capabilities rather than addressing a direct vulnerability or exploit.

Defensive guidance

To effectively leverage this threat intelligence, organizations should: 1) Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enable automated detection of related malicious activity. 2) Regularly update threat intelligence feeds and correlate these IOCs with internal logs and network traffic to identify potential compromises early. 3) Conduct threat hunting exercises using the indicators to proactively search for signs of compromise within the environment. 4) Train SOC analysts to interpret and act on OSINT-derived IOCs, ensuring timely investigation and response. 5) Maintain robust network segmentation and monitoring to limit the impact of any detected payload delivery attempts. 6) Collaborate with industry information sharing groups to validate and enrich the intelligence context. 7) Since no patches or direct fixes are available, focus on detection, containment, and response capabilities rather than remediation. These steps go beyond generic advice by emphasizing operational integration and proactive threat hunting based on the intelligence feed.

Community reviews

Loading reviews…