IndicatorPublished 6 Mar 2026Updated 7 Mar 2026

ThreatFox IOCs for 2026-03-06

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 882

avon-v9.avonkerosene.in.netClearFake payload delivery domain (confidence level: 100%)
trofedi.topSmartApeSG payload delivery domain (confidence level: 100%)
amfredio.comSmartApeSG payload delivery domain (confidence level: 100%)
kero01.avonkerosene.in.netClearFake payload delivery domain (confidence level: 100%)
gerony.topSmartApeSG payload delivery domain (confidence level: 100%)
flow-core.fluxbridge.in.netClearFake payload delivery domain (confidence level: 100%)
cryp-sync.cryptonest.in.netClearFake payload delivery domain (confidence level: 100%)
oriana84.comKongTuke payload delivery domain (confidence level: 100%)
heavens-gate.topKongTuke payload delivery domain (confidence level: 100%)
orga-sync.organiclink.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 43

https://trofedi.top/reset/admin-hook.jsSmartApeSG payload delivery URL (confidence level: 100%)
https://trofedi.top/reset/tenant-pipeline.phpSmartApeSG payload delivery URL (confidence level: 100%)
https://trofedi.top/reset/private-compiler.jsSmartApeSG payload delivery URL (confidence level: 100%)
https://amfredio.com/successSmartApeSG payload delivery URL (confidence level: 100%)
https://amfredio.com/serverSmartApeSG payload delivery URL (confidence level: 100%)
https://gerony.top/reset/tenant-pipeline.phpSmartApeSG payload delivery URL (confidence level: 100%)
https://gerony.top/reset/private-compiler.jsSmartApeSG payload delivery URL (confidence level: 100%)
https://oriana84.com/5a7h.jsKongTuke payload delivery URL (confidence level: 100%)
https://oriana84.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
https://heavens-gate.top/oKongTuke payload delivery URL (confidence level: 100%)

IP addresses 118

198.211.115.123Aisuru botnet C2 server (confidence level: 100%)
138.197.125.215Aisuru botnet C2 server (confidence level: 100%)
188.166.113.249Aisuru botnet C2 server (confidence level: 100%)
137.184.111.42Aisuru botnet C2 server (confidence level: 100%)
45.55.77.196Aisuru botnet C2 server (confidence level: 100%)
23.177.185.166DCRat botnet C2 server (confidence level: 100%)
147.27.121.6Unknown malware botnet C2 server (confidence level: 100%)
194.36.178.53AdaptixC2 botnet C2 server (confidence level: 100%)
109.172.87.216AdaptixC2 botnet C2 server (confidence level: 100%)
168.245.203.61Meterpreter botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-03-06

Impact

The potential impact of this threat is moderate given the medium severity rating and absence of active exploits or patches. Organizations worldwide may face increased risk of malware infections through payload delivery and network activity associated with the IOCs. While no direct vulnerability exploitation is indicated, the presence of these IOCs can help attackers identify targets or facilitate malware distribution campaigns. If unaddressed, this could lead to compromised systems, data breaches, or service disruptions depending on the malware involved. However, since no specific affected products or versions are identified, the scope of impact is broad but nonspecific, requiring organizations to rely on general malware detection and network monitoring capabilities. The threat primarily affects organizations that rely heavily on network security monitoring and threat intelligence integration to detect and respond to emerging malware campaigns.

Defensive guidance

Organizations should integrate these IOCs into their security information and event management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enhance detection of related malware activity. Regularly updating threat intelligence feeds and correlating with internal logs can improve early identification of suspicious payload delivery attempts or network anomalies. Network segmentation and strict egress filtering can limit malware spread and command-and-control communications. Endpoint detection and response (EDR) solutions should be tuned to detect behaviors consistent with payload delivery and network-based malware activity. Since no patches are available, focus should be on proactive monitoring, incident response readiness, and user awareness training to recognize phishing or social engineering attempts that may deliver malware. Conducting regular threat hunting exercises using the provided IOCs can help identify latent infections. Collaboration with threat intelligence sharing communities is recommended to stay updated on evolving indicators and tactics.

Community reviews

Loading reviews…