IndicatorPublished 28 Mar 2026Updated 29 Mar 2026

type osint · ThreatFox IOCs for 2026-03-28

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 310

polnexas.comSmartApeSG payload delivery domain (confidence level: 100%)
lemon.trueforceteam.ruUnknown Stealer botnet C2 domain (confidence level: 100%)
dreniko.topSmartApeSG payload delivery domain (confidence level: 100%)
dash.dcf.co.ilFAKEUPDATES botnet C2 domain (confidence level: 100%)
cl1store.horizonprospera.in.netClearFake payload delivery domain (confidence level: 100%)
cl2remote.horizonprospera.in.netClearFake payload delivery domain (confidence level: 100%)
cl3dev.horizonprospera.in.netClearFake payload delivery domain (confidence level: 100%)
cl4link.horizonprospera.in.netClearFake payload delivery domain (confidence level: 100%)
dev1proc.apexbloomera.in.netClearFake payload delivery domain (confidence level: 100%)
dev2power.apexbloomera.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 33

https://polnexas.com/pp/juneSmartApeSG payload delivery URL (confidence level: 100%)
https://autohaus-marku.de/Unknown malware payload delivery URL (confidence level: 90%)
https://beekey.de/Unknown malware payload delivery URL (confidence level: 90%)
https://dreniko.top/private/admin-serializer.phpSmartApeSG payload delivery URL (confidence level: 100%)
https://dreniko.top/private/endpoint-build.jsSmartApeSG payload delivery URL (confidence level: 100%)
https://ftp.massageessaouira.com/Unknown malware payload delivery URL (confidence level: 90%)
https://honeymoonersreviewguide.com/Unknown malware payload delivery URL (confidence level: 90%)
https://megaresellers.org/Unknown malware payload delivery URL (confidence level: 90%)
https://move.bong889.com/Unknown malware payload delivery URL (confidence level: 90%)
https://startherepage.net/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 36

151.243.109.125PXA Stealer botnet C2 server (confidence level: 90%)
176.65.139.80Mirai botnet C2 server (confidence level: 100%)
119.28.137.199ValleyRAT botnet C2 server (confidence level: 100%)
119.28.137.199ValleyRAT botnet C2 server (confidence level: 75%)
161.35.110.36XWorm botnet C2 server (confidence level: 100%)
77.83.39.130Quasar RAT botnet C2 server (confidence level: 100%)
13.53.130.204Quasar RAT botnet C2 server (confidence level: 100%)
74.211.98.224Cobalt Strike botnet C2 server (confidence level: 100%)
74.211.98.224Cobalt Strike botnet C2 server (confidence level: 100%)
168.231.114.49SmokeLoader botnet C2 server (confidence level: 75%)

Hashes 7

9fcd3a345bcbf24a6d33dd951dbcfe0ed52abf57c8cad0d08fac6bc3306437faPXA Stealer payload (confidence level: 100%)
d159edb63f4a8c38fe3f42dbada632112ee2fd411c46934bacadf006d9e62e10PXA Stealer payload (confidence level: 100%)
0033c82b54b38330c2e9f0a0d907eddb992fa8f78655162d81b922dfda426dbdUnknown Loader payload (confidence level: 100%)
00a15625e01f1f85c3899af7fb4350fabce5b532365b02f35464761516ad9a35Unknown Loader payload (confidence level: 100%)
560c5440e8bb4860aab2b95ef16668aa968a88e60c148b23be7aa472ec26cddcUnknown Loader payload (confidence level: 100%)
f0aa4631224de2d6fbdca63c40afb1eb741a4e731bbf0569762eaece68cab750PureRAT payload (confidence level: 75%)
e238e050add1afed134bdcd32c45c6982d931d172115ec824595808026d1b8caPureRAT payload (confidence level: 90%)

Description

ThreatFox IOCs for 2026-03-28

Impact

Given the lack of specific exploit details or affected software versions, the direct impact on organizations is currently limited. However, the presence of payload delivery and network activity indicators suggests potential for malware infections that could compromise confidentiality, integrity, or availability if exploited. Organizations worldwide that rely on threat intelligence feeds like ThreatFox may benefit from early warning and detection capabilities. The medium severity rating indicates a moderate risk level, implying that while immediate widespread damage is unlikely, targeted attacks or emerging campaigns could leverage these IOCs. Without known exploits in the wild, the threat is more informational, helping defenders prepare rather than respond to active incidents. Failure to incorporate such intelligence could delay detection of related malicious activity, increasing potential damage. The impact is thus primarily on detection and response capabilities rather than direct system compromise at this stage.

Defensive guidance

Organizations should integrate ThreatFox IOCs into their security monitoring and threat hunting workflows to enhance detection of related malware activity. Deploy network and endpoint detection tools capable of ingesting OSINT feeds and correlating indicators with internal logs. Conduct regular threat intelligence reviews to update detection rules and signatures based on emerging data. Employ network segmentation and strict access controls to limit potential payload delivery paths. Maintain robust incident response plans that include procedures for analyzing and responding to new threat intelligence. Since no patches are available, focus on proactive detection and containment strategies. Encourage collaboration with threat intelligence sharing communities to validate and enrich IOC data. Finally, conduct user awareness training to reduce the risk of social engineering vectors that often accompany payload delivery mechanisms.

Community reviews

Loading reviews…