IndicatorPublished 2 Feb 2026Updated 3 Feb 2026

ThreatFox IOCs for 2026-02-02

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 121

unknownrazer-39100.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
tamasomajyotirgamay.in.netAsyncRAT botnet C2 domain (confidence level: 100%)
p-el3keto.ru.comAsyncRAT botnet C2 domain (confidence level: 100%)
yoenacevedo7-51272.portmap.hostQuasar RAT botnet C2 domain (confidence level: 100%)
jyyjtjyt-63390.portmap.hostNjRAT botnet C2 domain (confidence level: 100%)
pdxing-szxmm-0127.comValleyRAT botnet C2 domain (confidence level: 100%)
win64autoupdates.topRaccoon botnet C2 domain (confidence level: 50%)
capztoolz.comClearFake payload delivery domain (confidence level: 100%)
ztdaliweb.shopClearFake payload delivery domain (confidence level: 100%)
alianzeg.shopClearFake payload delivery domain (confidence level: 100%)

URLs 51

https://cdn.jsdelivr.net/gh/relight-73-unsigned/coolray/eee12ClearFake payload delivery URL (confidence level: 100%)
http://138.226.237.35Stealc botnet C2 (confidence level: 100%)
https://mail.genesseevalleygolfcourse.com/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.destinationecuador.com/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.imeldaespinoza.com/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.istar-vip.com/Unknown malware payload delivery URL (confidence level: 90%)
https://lp.rainhadosconsorcios.com.br/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.bennnene.com/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.diskopumkm-minahasa.my.id/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.newday-gt.com/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 83

196.251.107.130Stealc botnet C2 server (confidence level: 100%)
138.226.237.35Stealc botnet C2 server (confidence level: 100%)
157.250.207.98Mirai botnet C2 server (confidence level: 80%)
156.226.21.115Ghost RAT botnet C2 server (confidence level: 100%)
216.126.224.83AsyncRAT botnet C2 server (confidence level: 100%)
155.138.211.85Unknown malware botnet C2 server (confidence level: 100%)
64.7.199.35AdaptixC2 botnet C2 server (confidence level: 100%)
16.50.158.8Meterpreter botnet C2 server (confidence level: 100%)
16.50.158.8Meterpreter botnet C2 server (confidence level: 100%)
185.209.161.130Mirai botnet C2 server (confidence level: 80%)

Description

ThreatFox IOCs for 2026-02-02

Impact

For European organizations, the impact of this threat is primarily related to increased exposure to network-based reconnaissance and potential payload delivery attempts. While no direct exploits or vulnerabilities are identified, the presence of OSINT-related malware activity suggests adversaries may be gathering intelligence to facilitate future attacks or deliver malicious payloads over networks. This could lead to unauthorized access, data exfiltration, or disruption if payloads are successfully delivered and executed. The medium severity indicates a moderate risk level, meaning organizations could experience operational impacts if defenses are insufficient. Sectors with high reliance on network infrastructure, such as finance, telecommunications, and government, may face greater risks. The lack of patches or specific mitigations means organizations must rely on proactive detection and response capabilities. Failure to detect such network activity could allow attackers to establish footholds or conduct further reconnaissance, increasing the likelihood of subsequent, more damaging attacks. Therefore, the threat underscores the need for continuous monitoring and threat intelligence integration to mitigate potential impacts.

Defensive guidance

European organizations should implement enhanced network monitoring to detect unusual or suspicious traffic patterns indicative of OSINT-related reconnaissance or payload delivery attempts. Integration of ThreatFox and other reputable threat intelligence feeds into Security Information and Event Management (SIEM) systems can improve detection of known IOCs. Employ network segmentation to limit lateral movement in case of successful payload delivery. Conduct regular threat hunting exercises focused on network activity and payload delivery vectors. Update incident response plans to include scenarios involving OSINT-driven reconnaissance and network-based malware. Educate security teams on the importance of analyzing OSINT-derived threats and correlating them with network telemetry. Deploy endpoint detection and response (EDR) solutions capable of identifying payload execution behaviors. Since no patches are available, prioritize preventive controls such as network access controls, strict firewall rules, and anomaly detection. Collaborate with national and European cybersecurity centers for timely sharing of threat intelligence and coordinated response. Finally, maintain up-to-date asset inventories to quickly identify and isolate affected systems if indicators are detected.

Community reviews

Loading reviews…