IndicatorPublished 12 Mar 2026Updated 13 Mar 2026

type osint · ThreatFox IOCs for 2026-03-12

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 214

analyticspixel.comUnknown malware payload delivery domain (confidence level: 100%)
uxcas7x8.skyip.in.netClearFake payload delivery domain (confidence level: 100%)
pineautum.lovone.in.netClearFake payload delivery domain (confidence level: 100%)
images.theuppercrafteroom.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
youcamefromus.comUnknown malware payload delivery domain (confidence level: 100%)
carswof.comUnknown malware payload delivery domain (confidence level: 100%)
whoiamsal.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
thesolnov.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
globalantitheft.comUnknown malware payload delivery domain (confidence level: 100%)
skydream.altovante.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 69

https://analyticspixel.com/ext-b.9423bd0b6b22.jsUnknown malware payload delivery URL (confidence level: 100%)
http://carswof.com/zill0.phpUnknown malware payload delivery URL (confidence level: 100%)
http://carswof.com/at.7zUnknown malware payload delivery URL (confidence level: 100%)
http://carswof.com/lnk.7zUnknown malware payload delivery URL (confidence level: 100%)
http://carswof.com/7z.exeUnknown malware payload delivery URL (confidence level: 100%)
http://carswof.com/7z.dllUnknown malware payload delivery URL (confidence level: 100%)
https://globalantitheft.com/Unknown malware payload delivery URL (confidence level: 100%)
https://youcamefromus.com/Unknown malware payload delivery URL (confidence level: 100%)
https://kernsjewe.com/osu.txtUnknown malware payload delivery URL (confidence level: 100%)
https://kernsjewe.com/fe.txtUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 196

217.119.129.121Unknown Stealer botnet C2 server (confidence level: 100%)
217.119.129.122Unknown Stealer botnet C2 server (confidence level: 100%)
156.234.74.231Cobalt Strike botnet C2 server (confidence level: 100%)
156.234.56.97Cobalt Strike botnet C2 server (confidence level: 100%)
156.234.208.77Cobalt Strike botnet C2 server (confidence level: 100%)
156.234.208.93Cobalt Strike botnet C2 server (confidence level: 100%)
156.234.166.236Cobalt Strike botnet C2 server (confidence level: 100%)
103.41.7.130Cobalt Strike botnet C2 server (confidence level: 100%)
156.234.208.80Cobalt Strike botnet C2 server (confidence level: 100%)
156.234.208.67Cobalt Strike botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-03-12

Impact

The potential impact of this threat is moderate, primarily affecting organizations that rely on network security monitoring and threat intelligence to detect and respond to malware payload delivery attempts. Since no active exploits or patches are noted, the immediate risk of compromise is low. However, the presence of payload delivery and network activity tags suggests that if these IOCs correspond to emerging malware campaigns, organizations could face risks such as unauthorized access, data exfiltration, or service disruption if the malware is successfully deployed. The lack of specific affected versions or products means the threat is broad and not targeted at a particular technology stack, potentially impacting diverse environments. The impact is mainly on the confidentiality and availability of systems if the payloads are malicious and executed. Organizations without mature threat detection capabilities may be slower to identify these threats, increasing potential damage. Overall, the impact is contained but warrants attention from security operations centers and incident response teams.

Defensive guidance

Organizations should integrate the provided ThreatFox IOCs into their security monitoring tools such as SIEMs, IDS/IPS, and endpoint detection and response (EDR) systems to enhance detection capabilities. Regularly updating threat intelligence feeds and correlating these IOCs with network traffic and endpoint logs can help identify early signs of malicious activity. Network segmentation and strict egress filtering can limit the ability of malware payloads to communicate externally or spread laterally. Employing behavioral analytics to detect anomalous network activity related to payload delivery is recommended. Since no patches are available, emphasis should be placed on proactive detection and response rather than remediation. Security teams should conduct threat hunting exercises using these IOCs to uncover potential compromises. Additionally, maintaining up-to-date backups and incident response plans will mitigate impact if an infection occurs. Collaboration with threat intelligence sharing communities can provide further context and updates on evolving threats.

Community reviews

Loading reviews…