IndicatorPublished 4 Mar 2026Updated 5 Mar 2026

ThreatFox IOCs for 2026-03-04

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 212

feedback.grovecitypestcontrol.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
haven-core.redhaven.in.netClearFake payload delivery domain (confidence level: 100%)
wind-unit.windcrest.in.netClearFake payload delivery domain (confidence level: 100%)
massimuta.ruUnknown malware payload delivery domain (confidence level: 100%)
soundlovlr.ruUnknown malware payload delivery domain (confidence level: 100%)
crest03.windcrest.in.netClearFake payload delivery domain (confidence level: 100%)
porora.icuUnknown malware payload delivery domain (confidence level: 100%)
air-path.windcrest.in.netClearFake payload delivery domain (confidence level: 100%)
wind-v1.windcrest.in.netClearFake payload delivery domain (confidence level: 100%)
joseph-stalin.topKongTuke payload delivery domain (confidence level: 100%)

URLs 86

http://114.66.58.11:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://massimuta.ru/xhamster.htmlUnknown malware payload delivery URL (confidence level: 100%)
https://soundlovlr.ru/xhamster.htmlUnknown malware payload delivery URL (confidence level: 100%)
http://103.27.156.206/most.pdfUnknown malware payload delivery URL (confidence level: 100%)
https://diskcitylink.com/winsxs/../compile/../debug/../gfgm0dy/c.wUnknown malware payload delivery URL (confidence level: 100%)
https://kko1ph.b3h5n3c0.workSpyBanker botnet C2 (confidence level: 50%)
https://rw3ukjj4q8l7.sayloot.com/SpyBanker botnet C2 (confidence level: 50%)
https://joseph-stalin.top/oKongTuke payload delivery URL (confidence level: 100%)
https://151.247.22.111/Vidar botnet C2 (confidence level: 100%)
http://144.31.25.150:5000/send_photoUnknown malware botnet C2 (confidence level: 100%)

IP addresses 129

143.110.220.20KongTuke botnet C2 server (confidence level: 100%)
43.249.175.197Cobalt Strike botnet C2 server (confidence level: 100%)
156.234.21.202Cobalt Strike botnet C2 server (confidence level: 100%)
23.248.213.121Cobalt Strike botnet C2 server (confidence level: 100%)
43.249.175.209Cobalt Strike botnet C2 server (confidence level: 100%)
80.76.49.67AsyncRAT botnet C2 server (confidence level: 100%)
54.196.199.151Unknown malware botnet C2 server (confidence level: 100%)
91.218.46.152Quasar RAT botnet C2 server (confidence level: 100%)
118.107.47.86Quasar RAT botnet C2 server (confidence level: 100%)
118.107.47.84Quasar RAT botnet C2 server (confidence level: 100%)

Hashes 4

Unknown malware payload (confidence level: 100%)

136e0bf4e5fe4d4249fe9570153a0b97
b54edbcec7664fde548a7ba1fa8b3b78
186c77101c027a465b14cb4a74f8381e
182024fc6c5fe0b1b33fdd9c7c37e368

Description

ThreatFox IOCs for 2026-03-04

Impact

Given the lack of specific affected products, exploit details, or active attack reports, the direct impact of this threat is currently low to medium. Organizations that rely on threat intelligence feeds like ThreatFox can use this information to improve their detection of malware-related network activity and payload delivery attempts. However, without concrete IOCs or exploit mechanisms, the risk of compromise remains theoretical. The primary impact is on the ability of security teams to maintain situational awareness and prepare defenses against emerging malware threats. If ignored, organizations might miss early warning signs of malware campaigns or payload delivery attempts. The medium severity rating reflects the potential for this intelligence to inform defenses but does not indicate an immediate or widespread threat.

Defensive guidance

1. Integrate ThreatFox and similar OSINT feeds into Security Information and Event Management (SIEM) and threat hunting platforms to enhance detection capabilities. 2. Regularly update and tune network monitoring tools to identify suspicious payload delivery patterns and malware-related network activity. 3. Conduct proactive threat hunting exercises using the latest IOCs from trusted sources to identify potential compromises early. 4. Maintain robust endpoint detection and response (EDR) solutions capable of detecting anomalous behaviors associated with malware payloads. 5. Train security analysts to interpret and act on OSINT data effectively, distinguishing between actionable threats and general intelligence. 6. Establish incident response playbooks that incorporate threat intelligence updates to streamline investigation and containment. 7. Collaborate with industry peers and information sharing groups to validate and enrich threat intelligence data. These steps go beyond generic advice by emphasizing integration, proactive hunting, and operationalizing OSINT data.

Community reviews

Loading reviews…