IndicatorPublished 30 Mar 2026Updated 31 Mar 2026

type osint · ThreatFox IOCs for 2026-03-30

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 352

true-presents-thereafter-und.trycloudflare.comEtherRAT botnet C2 domain (confidence level: 100%)
apparatus-contributions-understood-accommodation.trycloudflare.comEtherRAT botnet C2 domain (confidence level: 100%)
essayajewelry.comEtherRAT botnet C2 domain (confidence level: 100%)
detailingoff.comEtherRAT botnet C2 domain (confidence level: 100%)
scott-spring-netscape-monica.trycloudflare.comEtherRAT botnet C2 domain (confidence level: 100%)
dreambigworkharddomore.comEtherRAT botnet C2 domain (confidence level: 100%)
permission-resident-lots-ebooks.trycloudflare.comEtherRAT botnet C2 domain (confidence level: 100%)
lbimuseum.orgEtherRAT botnet C2 domain (confidence level: 100%)
dealing-economics-enrollment-firms.trycloudflare.comEtherRAT botnet C2 domain (confidence level: 100%)
globalwork.bestEtherRAT botnet C2 domain (confidence level: 100%)

URLs 94

https://kwsecurity.site/Unknown malware payload delivery URL (confidence level: 90%)
https://mybiggestjoy.bond/cf.jsUnknown malware payload delivery URL (confidence level: 100%)
https://mybiggestjoy.bond/api/index.phpUnknown malware payload delivery URL (confidence level: 100%)
https://mybiggestjoy.bond/log.phpUnknown malware payload delivery URL (confidence level: 100%)
https://djasdajnsdnjgjg.com/fdghdfgh.jsIClickFix payload delivery URL (confidence level: 100%)
https://sekolahtinta.edu.my/wp-blog-footer.phpIClickFix payload delivery URL (confidence level: 100%)
https://188.166.10.165Vidar botnet C2 (confidence level: 75%)
https://49.12.3.48Vidar botnet C2 (confidence level: 75%)
https://sekolahtinta.edu.my/wp-blog-footer.php?page=IClickFix payload delivery URL (confidence level: 100%)
https://136.244.96.112/Vidar botnet C2 (confidence level: 100%)

IP addresses 70

194.26.192.180Unidentified 001 botnet C2 server (confidence level: 75%)
20.5.49.243Unidentified 001 botnet C2 server (confidence level: 75%)
194.26.192.248Evilginx botnet C2 server (confidence level: 90%)
194.26.192.248Evilginx botnet C2 server (confidence level: 90%)
172.86.91.224Mirai botnet C2 server (confidence level: 80%)
107.158.128.79Rshell botnet C2 server (confidence level: 100%)
192.109.200.184Rshell botnet C2 server (confidence level: 75%)
64.89.161.130Mirai botnet C2 server (confidence level: 100%)
16.16.182.17WhiteSnake Stealer payload delivery server (confidence level: 90%)
103.182.228.91p0wnyshell payload delivery server (confidence level: 90%)

Hashes 2

DCRat payload (confidence level: 100%)

0000000000000000000000000000000000000000000000000000000000000000
6de95d766775a84a6683ffb116160078ca7c5a75a552cd79b748b652d151c222

Description

ThreatFox IOCs for 2026-03-30

Impact

The impact of this threat intelligence is primarily on an organization's ability to detect and respond to malware-related network activity. Since no active exploits or vulnerabilities are reported, the direct risk of compromise from this specific data is low. However, failure to incorporate these IOCs into security monitoring could result in missed detection opportunities, allowing malware infections or payload deliveries to go unnoticed. Organizations worldwide that rely on OSINT and network monitoring tools stand to benefit from this intelligence to enhance situational awareness and incident response. The medium severity rating reflects that while the threat is not immediately critical, it represents a meaningful contribution to defense-in-depth strategies. Without patches or active exploits, the impact is limited to detection capabilities rather than direct system compromise or data loss. The threat intelligence can help reduce dwell time of malware infections and improve overall security posture by enabling earlier identification of malicious activity.

Defensive guidance

To effectively leverage this threat intelligence, organizations should integrate the provided IOCs into their existing security infrastructure, including SIEM platforms, intrusion detection/prevention systems (IDS/IPS), endpoint detection and response (EDR) tools, and network monitoring solutions. Regularly updating threat feeds and correlating these IOCs with internal logs will enhance detection accuracy. Security teams should conduct threat hunting exercises using these indicators to identify any latent or ongoing malware activity. Since no patches are available, focus should be on detection, containment, and remediation of infections. Implementing network segmentation and strict egress filtering can limit payload delivery and lateral movement. Additionally, organizations should maintain robust incident response plans to quickly address any malware detections. Training security analysts on interpreting OSINT-based IOCs and understanding their context will improve response effectiveness. Finally, sharing findings and feedback with threat intelligence communities can help refine and expand the quality of future IOCs.

Community reviews

Loading reviews…