IndicatorPublished 11 Mar 2026Updated 12 Mar 2026

type osint · ThreatFox IOCs for 2026-03-11

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 269

bermanlawrsk.comEtherRAT botnet C2 domain (confidence level: 50%)
aurineuroth.comEtherRAT botnet C2 domain (confidence level: 50%)
wpuadmin.shopEtherRAT botnet C2 domain (confidence level: 50%)
palshona.comEtherRAT botnet C2 domain (confidence level: 50%)
chjunhao.comEtherRAT botnet C2 domain (confidence level: 50%)
ct-11q.moxitron.in.netClearFake payload delivery domain (confidence level: 100%)
logs.bestshopppingday.comPureRAT botnet C2 domain (confidence level: 100%)
mh.bestshopppingday.comPureRAT botnet C2 domain (confidence level: 100%)
h9v22.exoruby.in.netClearFake payload delivery domain (confidence level: 100%)
j1m44.exoruby.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 67

http://213.176.72.200Stealc botnet C2 (confidence level: 100%)
http://178.22.31.97Stealc botnet C2 (confidence level: 100%)
http://176.65.144.44Stealc botnet C2 (confidence level: 100%)
http://94.103.1.199/1e7cce2a32b54656.phpStealc botnet C2 (confidence level: 50%)
http://151.243.113.74/18fbf0e3b92f4383.phpStealc botnet C2 (confidence level: 50%)
http://37.221.66.166/4a815a53876a4172.phpStealc botnet C2 (confidence level: 50%)
http://45.150.32.124/fe8c4bbf5a1549fb.phpStealc botnet C2 (confidence level: 50%)
https://epy.nexs.com.bd/Vidar botnet C2 (confidence level: 100%)
https://epy.ssffaa18.xyz/Vidar botnet C2 (confidence level: 100%)
https://dgg.paihost.com/Vidar botnet C2 (confidence level: 100%)

IP addresses 191

77.91.65.172Stealc botnet C2 server (confidence level: 75%)
77.91.96.253Stealc botnet C2 server (confidence level: 75%)
91.92.242.4Stealc botnet C2 server (confidence level: 75%)
23.94.252.49Stealc botnet C2 server (confidence level: 75%)
158.94.211.17Stealc botnet C2 server (confidence level: 75%)
144.208.127.64Stealc botnet C2 server (confidence level: 75%)
144.172.101.155Stealc botnet C2 server (confidence level: 75%)
166.88.2.38Stealc botnet C2 server (confidence level: 75%)
36.212.7.2Cobalt Strike botnet C2 server (confidence level: 100%)
45.133.180.146Remcos botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-03-11

Impact

Given the lack of specific affected products, no known exploits, and absence of detailed technical indicators, the immediate impact on organizations worldwide is limited. However, the presence of payload delivery and network activity tags suggests potential risks of malware infection if related IOCs are encountered in operational environments. Organizations could face risks such as unauthorized access, data exfiltration, or service disruption if these payloads are successfully delivered and executed. The medium severity rating reflects moderate concern, primarily due to the potential for these IOCs to be part of broader attack campaigns. The lack of patches or fixes indicates that mitigation relies on detection and prevention controls rather than vulnerability remediation. Organizations without robust network monitoring or endpoint detection may be more susceptible to undetected compromise. The intelligence is valuable for enhancing threat hunting and incident response but does not indicate an immediate widespread threat or critical vulnerability.

Defensive guidance

1. Integrate the provided ThreatFox IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection capabilities. 2. Conduct regular network traffic analysis focusing on unusual payload delivery attempts and suspicious network activity patterns. 3. Employ threat hunting exercises using the IOCs to identify potential compromises proactively. 4. Maintain up-to-date threat intelligence feeds and correlate with internal logs to detect emerging threats early. 5. Implement strict network segmentation and least privilege access controls to limit potential malware spread if payload delivery is successful. 6. Ensure endpoint security solutions are configured to detect and block known malware behaviors associated with payload delivery. 7. Educate security teams on interpreting OSINT-based threat intelligence to improve response times and accuracy. 8. Regularly review and update incident response plans to incorporate new intelligence and detection strategies. These steps go beyond generic advice by emphasizing integration of specific IOCs, proactive threat hunting, and operationalizing OSINT intelligence within security workflows.

Community reviews

Loading reviews…