IndicatorPublished 8 Mar 2026Updated 9 Mar 2026

ThreatFox IOCs for 2026-03-08

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 314

grove-flow.mistgrove.in.netClearFake payload delivery domain (confidence level: 100%)
creek-base.shadowcreek.in.netClearFake payload delivery domain (confidence level: 100%)
www.filmdex.netHook botnet C2 domain (confidence level: 100%)
www.enguncelhaber.netHook botnet C2 domain (confidence level: 100%)
shad-net.shadowcreek.in.netClearFake payload delivery domain (confidence level: 100%)
7ykwhvxv.austeritymorg.digitalClearFake payload delivery domain (confidence level: 100%)
pgubdbmp.austeritymorg.digitalClearFake payload delivery domain (confidence level: 100%)
prim-sync.vortexis.in.netClearFake payload delivery domain (confidence level: 100%)
vort-node.vortexis.in.netClearFake payload delivery domain (confidence level: 100%)
marianayumi.com.brStrelaStealer payload delivery domain (confidence level: 100%)

URLs 17

https://cf-n3-syncflow.t3.storage.dev/index.html?x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=tid_wnnisps__tskokdg_uwkaghhuvhbcshbutgbmxtaqtxsqtrdfy%2f20260308%2fauto%2fs3%2faws4_request&x-amz-date=20260308t012517z&x-amz-expires=2160000&x-amz-signedheaders=host&x-amz-signature=0c6127b6b5eb246fb1abc8f341052f986cdb17239152f149b6dd56d64b7e2dbdUnknown malware payload delivery URL (confidence level: 90%)
http://46.28.70.102/sp11rt4m/puppetsafeguard.ps1Unknown malware payload delivery URL (confidence level: 100%)
http://www.sunamien.jp/cgi/up/uploader.cgi?mode=downld&no=55Unknown malware payload delivery URL (confidence level: 100%)
https://nu-5-vision-check.t3.storage.dev/index.html?x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=tid_maamgppgmlproedyjizqtl_dkaqeercilvsfwsffgbkhwqcsnv%2f20260308%2fauto%2fs3%2faws4_request&x-amz-date=20260308t012654z&x-amz-expires=2160000&x-amz-signedheaders=host&x-amz-signature=92cea969c5827e9d296d69581418e6c26de0a62870dc793b9b7077f73eebd7b7Unknown malware payload delivery URL (confidence level: 90%)
http://curtainjors.fun/apiLumma Stealer botnet C2 (confidence level: 75%)
http://179.43.163.126/datalib/315y9t.cwblRhadamanthys botnet C2 (confidence level: 100%)
https://utinam.fr/Unknown malware payload delivery URL (confidence level: 90%)
https://207.180.58.3/Vidar botnet C2 (confidence level: 100%)
http://146.103.113.60/get.phpUnknown malware botnet C2 (confidence level: 100%)
http://static03.site/1.phpUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 75

178.128.174.202Aisuru botnet C2 server (confidence level: 100%)
114.55.247.68Cobalt Strike botnet C2 server (confidence level: 100%)
152.32.171.230Cobalt Strike botnet C2 server (confidence level: 100%)
43.226.45.85Ghost RAT botnet C2 server (confidence level: 100%)
18.189.113.48Unknown malware botnet C2 server (confidence level: 100%)
209.74.81.37Hook botnet C2 server (confidence level: 100%)
69.167.10.238DCRat botnet C2 server (confidence level: 100%)
39.104.21.2VShell botnet C2 server (confidence level: 100%)
68.183.110.36AdaptixC2 botnet C2 server (confidence level: 100%)
3.143.213.228Empire Downloader botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-03-08

Impact

The potential impact of this threat is moderate, primarily affecting organizations that rely heavily on networked systems and are exposed to OSINT-driven reconnaissance and payload delivery attacks. Successful exploitation could lead to unauthorized access, data exfiltration, or initial footholds for further compromise. However, the absence of known exploits and patches suggests the threat is not currently widespread or actively exploited at scale. Organizations worldwide could face increased network activity related to reconnaissance and payload delivery attempts, potentially leading to targeted phishing or malware campaigns. The impact on confidentiality, integrity, and availability is medium, as attackers may gain access to sensitive information or disrupt services if payloads are successfully delivered and executed. The threat's moderate distribution potential indicates a risk of propagation but not at a critical level. Overall, the threat could strain security monitoring resources and require enhanced vigilance but is unlikely to cause immediate, severe damage without further development or exploitation.

Defensive guidance

To mitigate this threat, organizations should implement enhanced network monitoring focused on detecting unusual payload delivery and OSINT-related reconnaissance activities. Deploy advanced intrusion detection and prevention systems (IDS/IPS) capable of identifying suspicious network traffic patterns associated with payload delivery. Strengthen email and web filtering to block phishing attempts and malicious payloads that may leverage OSINT data for targeting. Conduct regular threat intelligence updates incorporating ThreatFox and similar OSINT feeds to stay informed about emerging indicators. Employ user awareness training emphasizing the risks of social engineering and payload delivery vectors. Implement network segmentation to limit lateral movement if initial compromise occurs. Since no patches are available, focus on proactive detection, incident response readiness, and continuous monitoring rather than relying on vulnerability remediation. Additionally, leverage endpoint detection and response (EDR) tools to identify and contain payload execution promptly. Collaborate with threat intelligence communities to share findings and improve detection capabilities related to this evolving threat.

Community reviews

Loading reviews…