IndicatorPublished 16 Mar 2026Updated 17 Mar 2026

type osint · ThreatFox IOCs for 2026-03-16

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 719

dist-z02-edge.ponteluna.in.netClearFake payload delivery domain (confidence level: 100%)
t0-node-edge.ventonovo.in.netClearFake payload delivery domain (confidence level: 100%)
k4-sync-auth.ventonovo.in.netClearFake payload delivery domain (confidence level: 100%)
w9-dist-meta.ventonovo.in.netClearFake payload delivery domain (confidence level: 100%)
m1-infra-static.ventonovo.in.netClearFake payload delivery domain (confidence level: 100%)
originaleins.comStrelaStealer payload delivery domain (confidence level: 100%)
v7-srv-gate.focozero.in.netClearFake payload delivery domain (confidence level: 100%)
z3-app-data.focozero.in.netClearFake payload delivery domain (confidence level: 100%)
x5-web-proxy.focozero.in.netClearFake payload delivery domain (confidence level: 100%)
c2-core-sync.focozero.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 183

http://45.32.150.251:4789/socket.io/GlassWorm botnet C2 (confidence level: 100%)
https://slotmachinesgroup.com/Unknown malware payload delivery URL (confidence level: 90%)
https://195.201.248.201Vidar botnet C2 (confidence level: 75%)
https://74.0.32.108Vidar botnet C2 (confidence level: 75%)
https://followw.cyouLumma Stealer botnet C2 (confidence level: 100%)
https://147.124.221.241:1149/9c59034ac60846f8/mrx8h4of.prxvoRhadamanthys botnet C2 (confidence level: 100%)
https://tabbysbakescodes.ws/cnb/gate.phpUnknown malware botnet C2 (confidence level: 100%)
https://fks.rvoox.com/Vidar botnet C2 (confidence level: 100%)
https://fks.ssffaa1.xyz/Vidar botnet C2 (confidence level: 100%)
http://82.38.71.155/SmokeLoader botnet C2 (confidence level: 100%)

IP addresses 195

138.197.81.89Aisuru botnet C2 server (confidence level: 100%)
166.62.100.52Meterpreter botnet C2 server (confidence level: 100%)
193.36.38.237Rhadamanthys botnet C2 server (confidence level: 75%)
188.34.195.44Rhadamanthys botnet C2 server (confidence level: 75%)
138.199.156.22Rhadamanthys botnet C2 server (confidence level: 75%)
87.120.93.98Rhadamanthys botnet C2 server (confidence level: 75%)
217.91.235.17NetSupportManager RAT botnet C2 server (confidence level: 75%)
45.94.47.224NetSupportManager RAT botnet C2 server (confidence level: 75%)
88.214.27.48NetSupportManager RAT botnet C2 server (confidence level: 75%)
38.146.28.242NetSupportManager RAT botnet C2 server (confidence level: 75%)

Hashes 24

e14d7846c93e4a6cb9f745f1fa7943f6Meterpreter payload (confidence level: 100%)
d6eaef59c45067b0ec555d56b6cb8d1d5f987279d9bb3a996f85e222159215acMeterpreter payload (confidence level: 100%)
9ee58eb59e337c06429ff3f0afd0ee6886b0644ddd4531305b269e97ad2b8d42Lumma Stealer payload (confidence level: 75%)
dc95f7c7fb98ec30d3cb03963865a11d1b7b696e34f163b8de45f828b62ec829Lumma Stealer payload (confidence level: 75%)
62c6ba7f5356663c46b8918b6a0994fcUnknown malware payload (confidence level: 75%)
b400c58e7e227361cc689078ce9163c4Unknown malware payload (confidence level: 75%)
3b18e9da970fa7d336b08c5df04668b7Unknown malware payload (confidence level: 75%)
511a4780cbd9ed2280b432afc6cbfd1aUnknown malware payload (confidence level: 75%)
b8c81e1e17adcaf9e84d76401697b7e5Unknown malware payload (confidence level: 75%)
fdba5be3da2467e642bd8710f971e6b266b30ac15f5f413982fd719d7e0bffd9GlassWorm payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-03-16

Impact

While no active exploits or specific vulnerabilities are reported, the presence of malware-related IOCs in OSINT and network activity categories indicates potential risks for organizations that rely heavily on open-source intelligence tools or have exposure to network-based payload delivery mechanisms. If leveraged by threat actors, these IOCs could facilitate detection evasion, lateral movement, or initial compromise. The medium severity suggests moderate risk to confidentiality, integrity, and availability if exploited, but the lack of known exploits reduces immediate impact likelihood. Organizations worldwide could face increased reconnaissance or targeted malware delivery attempts, potentially leading to data breaches or operational disruptions if defenses are inadequate. However, the absence of patches and exploit reports implies that this threat is currently more informational and preparatory rather than actively harmful.

Defensive guidance

Organizations should integrate ThreatFox and similar OSINT feeds into their security monitoring and incident response workflows to enhance detection capabilities. Employ network traffic analysis tools to identify suspicious payload delivery attempts and anomalous network activity consistent with the IOCs once available. Maintain robust endpoint detection and response (EDR) solutions to detect and contain malware infections early. Conduct regular threat hunting exercises focusing on OSINT-related attack vectors and payload delivery mechanisms. Since no patches are available, emphasize proactive defense measures such as network segmentation, strict access controls, and user training to reduce attack surface. Collaborate with threat intelligence communities to obtain updated IOCs and contextual information. Finally, validate and enrich threat data before operational use to avoid false positives and optimize response actions.

Community reviews

Loading reviews…