IndicatorPublished 5 Mar 2026Updated 6 Mar 2026

ThreatFox IOCs for 2026-03-05

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 270

yelpmo.comUnknown malware payload delivery domain (confidence level: 100%)
vipflorence.comUnknown malware payload delivery domain (confidence level: 100%)
stylenemesiis.commagecart payload delivery domain (confidence level: 50%)
stylewowcafwe.commagecart payload delivery domain (confidence level: 50%)
stylecanoonon.commagecart payload delivery domain (confidence level: 50%)
ofaskfaksfmtjmka.comUnknown malware payload delivery domain (confidence level: 100%)
plixoworks.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
plixolabsaf.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
mvjfkakfkfkaiai.comUnknown malware payload delivery domain (confidence level: 100%)
zevoroz.comNetSupportManager RAT payload delivery domain (confidence level: 100%)

URLs 124

https://3v5w1km5gv.xyz/group.htmlUnknown malware payload delivery URL (confidence level: 100%)
http://213.5.130.197Unknown malware botnet C2 (confidence level: 100%)
http://213.5.130.154Unknown malware botnet C2 (confidence level: 100%)
http://213.5.130.200Unknown malware botnet C2 (confidence level: 100%)
http://213.5.130.131Unknown malware botnet C2 (confidence level: 100%)
http://213.5.130.179Unknown malware botnet C2 (confidence level: 100%)
http://213.5.130.189Unknown malware botnet C2 (confidence level: 100%)
http://5.175.234.213/small.batUnknown malware payload delivery URL (confidence level: 100%)
http://5.175.234.213/test.txtUnknown malware payload delivery URL (confidence level: 100%)
https://ofaskfaksfmtjmka.com/kkaksf.jsUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 375

84.32.98.123Mirai botnet C2 server (confidence level: 80%)
84.32.98.123Mirai botnet C2 server (confidence level: 80%)
47.105.100.60Cobalt Strike botnet C2 server (confidence level: 100%)
172.245.246.80Remcos botnet C2 server (confidence level: 100%)
45.83.31.190Remcos botnet C2 server (confidence level: 100%)
23.95.117.227Remcos botnet C2 server (confidence level: 100%)
154.91.4.3Unknown malware botnet C2 server (confidence level: 100%)
195.24.237.45Hook botnet C2 server (confidence level: 100%)
141.164.62.120Havoc botnet C2 server (confidence level: 100%)
139.224.135.193Venom RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-03-05

Impact

The potential impact of this threat is currently limited due to the absence of known exploits in the wild and lack of specific affected software versions. However, as it involves malware payload delivery and network activity, organizations could face risks such as unauthorized access, data exfiltration, or disruption if the payloads are successfully delivered and executed. The medium severity rating suggests a moderate risk level, where exploitation could lead to confidentiality breaches or integrity compromises but is not yet widespread or highly destructive. Since no patches or direct mitigations are available, organizations might experience challenges in fully defending against this threat without enhanced detection capabilities. The impact is primarily on organizations that rely heavily on network security monitoring and OSINT-related threat intelligence, including government, defense, and critical infrastructure sectors that are frequent targets of sophisticated payload delivery campaigns.

Defensive guidance

1. Integrate the ThreatFox IOCs into existing security information and event management (SIEM) and intrusion detection/prevention systems (IDS/IPS) to enhance detection of related network activity and payload delivery attempts. 2. Conduct regular network traffic analysis focusing on unusual payload delivery patterns or OSINT-related reconnaissance behaviors. 3. Employ threat hunting exercises using the provided IOCs and related OSINT data to identify potential early-stage compromises. 4. Maintain updated endpoint detection and response (EDR) solutions capable of identifying suspicious payload execution. 5. Enhance user awareness and training on phishing and social engineering tactics that may be used to deliver payloads. 6. Collaborate with threat intelligence sharing communities to receive timely updates and contextual information on emerging threats. 7. Implement network segmentation and strict access controls to limit lateral movement if payload delivery is successful. 8. Since no patches are available, focus on proactive detection and containment rather than reactive patching.

Community reviews

Loading reviews…