IndicatorPublished 1 Apr 2026Updated 2 Apr 2026

type osint · ThreatFox IOCs for 2026-04-01

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 266

bsmaopm.duckdns.orgPureRAT botnet C2 domain (confidence level: 100%)
star-map.astrahaven.in.netClearFake payload delivery domain (confidence level: 100%)
synapse-net.neurobloom.in.netClearFake payload delivery domain (confidence level: 100%)
api.permanentothertheorist.comClearFake payload delivery domain (confidence level: 50%)
nerve-center.neurobloom.in.netClearFake payload delivery domain (confidence level: 100%)
bio-sensor.neurobloom.in.netClearFake payload delivery domain (confidence level: 100%)
mesh-proxy.cyberhaven.in.netClearFake payload delivery domain (confidence level: 100%)
secure-vault.cyberhaven.in.netClearFake payload delivery domain (confidence level: 100%)
enc-tunnel.cyberhaven.in.netClearFake payload delivery domain (confidence level: 100%)
range-extend.signalcrest.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 64

https://thebusinessaccelerator.com/Unknown malware payload delivery URL (confidence level: 90%)
https://discord.com/api/webhooks/960954050583613549/yakgomn5eytrpchuopz87piks7wk2xpb5y3ozzqxaaho2vcbn99g7k9oqsapj9ji7btrUnknown malware botnet C2 (confidence level: 100%)
https://bemqorli.top/logout/admin-worker.jsSmartApeSG payload delivery URL (confidence level: 100%)
http://150.241.65.94/sc32Unknown malware payload delivery URL (confidence level: 75%)
https://204.168.172.164Vidar botnet C2 (confidence level: 75%)
https://204.168.220.27Vidar botnet C2 (confidence level: 75%)
http://e732a5ae.xyz/index.phpUnknown RAT botnet C2 (confidence level: 100%)
http://e732a5ae.top/index.phpUnknown RAT botnet C2 (confidence level: 100%)
http://a2b5caf8.buzz/2/index.phpUnknown RAT botnet C2 (confidence level: 100%)
http://fortlauderdalelemonlaw.com/curl/6e94eaa0bb819eb49d74473da0a4c4afb8df11080d512813d135ce1cc8dcf403Unknown malware payload delivery URL (confidence level: 100%)

IP addresses 65

12.202.180.133PureRAT botnet C2 server (confidence level: 100%)
49.51.134.147Xtreme RAT botnet C2 server (confidence level: 100%)
50.39.155.159Nanocore RAT botnet C2 server (confidence level: 100%)
217.69.2.135GlassWorm botnet C2 server (confidence level: 100%)
150.241.65.94Unknown malware botnet C2 server (confidence level: 100%)
150.241.65.94Unknown malware botnet C2 server (confidence level: 100%)
172.245.4.226Remcos botnet C2 server (confidence level: 100%)
192.227.219.95Remcos botnet C2 server (confidence level: 100%)
45.153.34.120AdaptixC2 botnet C2 server (confidence level: 100%)
95.40.168.23ValleyRAT botnet C2 server (confidence level: 75%)

Hashes 6

12a8b0903c176cb6478b4f0bfcf8a621025c37faf83941125c803ccc3e0913e6AdaptixC2 payload (confidence level: 100%)
a4ccfa85bf0faf1caad12a410342ce977418f50a14094d045e2c9e861bd2f934AdaptixC2 payload (confidence level: 100%)
929e28c42c72fc0de845fa3e77a9aed790b74249cf0700026ee89b1db6eabe25AdaptixC2 payload (confidence level: 100%)
abac8cd80711555a39d73e5aeab4919af37de95d057038778b737071dc35bb88AdaptixC2 payload (confidence level: 100%)
4b467906789b3abaeeaab4483efc9a8b6b6dda044520fdd07526e71cb160b614AdaptixC2 payload (confidence level: 100%)
5577857d4b69217b12f59c8fd58b8e8ce57645ff19097c00693733bca86abb63Unknown malware payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-04-01

Impact

Given the lack of detailed exploit information and no known active exploitation, the immediate impact on organizations worldwide is limited. However, the presence of malware-related IOCs in OSINT feeds suggests ongoing reconnaissance or low-level payload delivery campaigns that could lead to data breaches, system compromise, or network disruptions if leveraged effectively by threat actors. Organizations relying heavily on network monitoring and threat intelligence may benefit from integrating these IOCs to detect early signs of compromise. The medium severity rating reflects a moderate risk of impact on confidentiality, integrity, or availability if the malware payloads are successfully delivered and executed. Without patches or specific mitigations, organizations must rely on detection and response capabilities to limit potential damage. The threat could affect a broad range of sectors, especially those with high exposure to network-based attacks or those that utilize OSINT for threat detection.

Defensive guidance

1. Integrate ThreatFox IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection capabilities. 2. Conduct regular network traffic analysis to identify unusual payload delivery patterns or suspicious network activity. 3. Maintain updated threat intelligence feeds and correlate with internal logs to detect early signs of compromise. 4. Employ network segmentation and strict access controls to limit the spread of potential malware payloads. 5. Train security teams to recognize and respond to indicators related to OSINT-sourced threats. 6. Since no patches are available, focus on proactive monitoring, incident response readiness, and rapid containment strategies. 7. Regularly update and test backup and recovery procedures to mitigate potential data loss from malware infections. 8. Collaborate with threat intelligence communities to share findings and improve collective defense.

Community reviews

Loading reviews…