IndicatorPublished 17 Mar 2026Updated 18 Mar 2026

type osint · ThreatFox IOCs for 2026-03-17

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 380

phantom-mods.comUnknown malware payload delivery domain (confidence level: 100%)
carminemods.ccUnknown malware payload delivery domain (confidence level: 100%)
orbit-v7-moon.vitalocus.in.netClearFake payload delivery domain (confidence level: 100%)
dist-ctroy.topSmartApeSG payload delivery domain (confidence level: 100%)
p1-sync-v9.arcostruttura.in.netClearFake payload delivery domain (confidence level: 100%)
h4-node-00.pietraforte.in.netClearFake payload delivery domain (confidence level: 100%)
y1-point-v7.viametrica.in.netClearFake payload delivery domain (confidence level: 100%)
e9-trace-x.columnasol.in.netClearFake payload delivery domain (confidence level: 100%)
a2-ghost-v3.columnasol.in.netClearFake payload delivery domain (confidence level: 100%)
m5-vision-9.columnasol.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 98

https://dist-ctroy.top/tenant/refresh-request.phpSmartApeSG payload delivery URL (confidence level: 100%)
https://dist-ctroy.top/tenant/session-sandbox.jsSmartApeSG payload delivery URL (confidence level: 100%)
https://certiouts.com/user/contentSmartApeSG payload delivery URL (confidence level: 100%)
https://nelark.icu/xftaswx/res/bb.phpUnknown RAT payload delivery URL (confidence level: 75%)
https://nelark.icu/xftaswx/res/post_proc.php?fpath=bpersist.ps1Unknown RAT payload delivery URL (confidence level: 75%)
https://nelark.icu/xftaswx/res/post_proc.php?fpath=scheduler-onceUnknown RAT payload delivery URL (confidence level: 75%)
https://nelark.icu/xftaswx/res/post_proc.php?fpath=bypass.bUnknown RAT payload delivery URL (confidence level: 75%)
https://nelark.icu/xftaswx/res/post_proc.php?fpath=a.ps1Unknown RAT payload delivery URL (confidence level: 75%)
https://nelark.icu/xftaswx/res/get-command.phpUnknown RAT payload delivery URL (confidence level: 75%)
https://airguard.me/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 322

176.65.139.67Mirai botnet C2 server (confidence level: 80%)
146.190.68.231Aisuru botnet C2 server (confidence level: 100%)
104.248.12.115Aisuru botnet C2 server (confidence level: 100%)
156.234.74.252Cobalt Strike botnet C2 server (confidence level: 100%)
155.138.205.173Cobalt Strike botnet C2 server (confidence level: 100%)
156.234.56.58Cobalt Strike botnet C2 server (confidence level: 100%)
185.113.223.254Remcos botnet C2 server (confidence level: 100%)
45.150.66.52Remcos botnet C2 server (confidence level: 100%)
147.124.222.49Remcos botnet C2 server (confidence level: 100%)
177.161.176.60Unknown malware botnet C2 server (confidence level: 100%)

Hashes 12

b02337d82c44ed46e5b186bd54cde717be39da81a29fb332090d10a5c444ccb6BillGates payload (confidence level: 75%)
1e3eb765015fd335cfdcb0ddd020565690b5a2f15a2a62406d750bcb21b6d77bKaiji payload (confidence level: 75%)
19aa99fe75f60f40e778366af1ef97b0Unknown malware payload (confidence level: 100%)
04f724ede202f84bd8eddccc234eded3Unknown malware payload (confidence level: 100%)
5d70e359d4f086f31395cf935a620265Unknown malware payload (confidence level: 100%)
b5085da2a8ecd8f74b66bfc6293f3acfUnknown malware payload (confidence level: 100%)
6c40aa0662e6d774b6fed9cbb4a14defUnknown malware payload (confidence level: 100%)
92b93cb23dafbb49305910fda4a58be7Unknown malware payload (confidence level: 100%)
6423278e10df9cff9514e8bfc6517289Unknown malware payload (confidence level: 100%)
5d55fb708834d5ccde15d36554ea63e8Unknown malware payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-03-17

Impact

Given the lack of specific exploit details or active attacks, the immediate impact on organizations worldwide is limited. However, the presence of payload delivery and network activity tags indicates potential risks of malware infection if these IOCs correspond to emerging or ongoing campaigns. Organizations relying on OSINT feeds for threat intelligence may benefit from early warnings, enabling them to detect and block suspicious network traffic or payloads. Without patches or known exploits, the threat likely involves reconnaissance or initial infection stages rather than full compromise. The medium severity suggests moderate risk, primarily to organizations with high exposure to external network traffic or those targeted by threat actors using OSINT techniques. Failure to incorporate such intelligence could delay detection of malware campaigns, increasing exposure to data breaches, service disruption, or lateral movement within networks. Overall, the impact is situational and dependent on the organization's threat landscape and security posture.

Defensive guidance

1. Integrate ThreatFox and similar OSINT feeds into Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection capabilities for known IOCs. 2. Conduct regular network traffic analysis focusing on unusual payload delivery patterns or connections to suspicious domains/IPs identified in OSINT feeds. 3. Employ network segmentation and strict egress filtering to limit the impact of potential malware payloads reaching critical systems. 4. Maintain updated endpoint detection and response (EDR) solutions capable of identifying anomalous behaviors associated with payload delivery and network activity. 5. Train security teams to interpret OSINT data effectively, correlating it with internal logs to identify early signs of compromise. 6. Establish incident response playbooks that include procedures for handling alerts derived from OSINT-based IOCs. 7. Encourage collaboration with threat intelligence sharing communities to stay informed about evolving threats and validation of IOCs. 8. Since no patches are available, focus on detection and containment strategies rather than remediation of vulnerabilities.

Community reviews

Loading reviews…