IndicatorPublished 3 Feb 2026Updated 4 Feb 2026

ThreatFox IOCs for 2026-02-03

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 66

hungry-pixel.comSantaStealer botnet C2 domain (confidence level: 100%)
lazaniaabstract.comStealc botnet C2 domain (confidence level: 100%)
soulversr.comKongTuke payload delivery domain (confidence level: 100%)
tiapolif.comSmartApeSG payload delivery domain (confidence level: 100%)
ingodgracebabyangelgivenblesswellwithmyl.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
itallgrealomeirac.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
greatmindzcroll.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
plattwistinit.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
x1egreatmindzcroll.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
x1eplattwistinit.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)

URLs 32

https://lazaniaabstract.com/86e134dc3955440b.phpStealc botnet C2 (confidence level: 100%)
http://89.223.95.97:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://soulversr.com/1d2g.jsKongTuke payload delivery URL (confidence level: 100%)
https://soulversr.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
https://tiapolif.com/tenant/redirect-effect.phpSmartApeSG payload delivery URL (confidence level: 100%)
https://tiapolif.com/tenant/dashboard-thread.jsSmartApeSG payload delivery URL (confidence level: 100%)
http://193.111.208.17/metricsSmartApeSG payload delivery URL (confidence level: 100%)
https://verotibet.com/metricsSmartApeSG payload delivery URL (confidence level: 100%)
https://193.111.208.17/loggerSmartApeSG payload delivery URL (confidence level: 100%)
https://www.rigogabriele.it/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 144

150.241.83.5Stealc botnet C2 server (confidence level: 100%)
104.248.130.195NjRAT botnet C2 server (confidence level: 99%)
23.94.252.101XWorm botnet C2 server (confidence level: 100%)
185.208.156.187Remcos botnet C2 server (confidence level: 100%)
192.109.139.158Remcos botnet C2 server (confidence level: 100%)
161.248.178.224Remcos botnet C2 server (confidence level: 100%)
216.126.225.121Mirai botnet C2 server (confidence level: 100%)
64.52.80.153MintsLoader botnet C2 server (confidence level: 50%)
147.185.221.212XWorm botnet C2 server (confidence level: 100%)
192.109.200.60Mirai botnet C2 server (confidence level: 100%)

Hashes 159

2d3769a8db9e187765c690c6070c9a37343f31e0ValleyRAT payload (confidence level: 95%)
6a25cf8ca25379e296985987ab0836301ee6e255868ef013276ba8e360cceb33ValleyRAT payload (confidence level: 95%)
662b5ce37b3e1f271dc24973a0c4fc4fValleyRAT payload (confidence level: 95%)
d8add360140a9ba5355bd6eff68035569b7e3c11Formbook payload (confidence level: 95%)
750d0ef6eaaac00190a10d38493cf765fcb9a9076ecf4d52ca356af4a650585fFormbook payload (confidence level: 95%)
99c0992338796dc80d99a0fba3797b38Formbook payload (confidence level: 95%)
a2d94dcdb8797ef93dc1c6ebbaa3271b11f1b225SalatStealer payload (confidence level: 95%)
6245e67431904902ef9e3e15ab69ea9e77fdf5541b3916ebc7593295bf3bee21SalatStealer payload (confidence level: 95%)
07c59ea0d9dfe8f02c9396ed2c2c4e6aSalatStealer payload (confidence level: 95%)
b5b891856155775874600ab9a66cdd54686bac68Quasar RAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-02-03

Impact

Given the lack of specific affected products or exploit details, the direct impact on European organizations is currently limited. However, the presence of OSINT-related network activity and payload delivery indicators suggests potential reconnaissance or early-stage intrusion attempts that could precede more severe attacks. European entities involved in critical infrastructure, government, or sectors with high-value data could be indirectly impacted if these IOCs correlate with targeted campaigns. The medium severity rating reflects moderate risk, primarily due to the potential for these indicators to inform or enable future attacks rather than immediate compromise. Without known exploits or active campaigns, the immediate confidentiality, integrity, and availability risks remain low but warrant monitoring.

Defensive guidance

Organizations should integrate these IOCs into their existing threat intelligence platforms and security monitoring tools to enhance detection capabilities. Network traffic should be analyzed for any matches to the provided indicators, focusing on unusual OSINT-related activities and payload delivery patterns. Endpoint detection and response (EDR) solutions should be updated to recognize behaviors associated with these IOCs. Regular threat intelligence sharing with industry peers and national cybersecurity centers can improve collective awareness. Since no patches are available, emphasis should be placed on proactive monitoring, anomaly detection, and incident response preparedness. Training security teams to recognize early signs of reconnaissance and payload delivery attempts can reduce the risk of escalation. Finally, organizations should validate their network segmentation and access controls to limit potential lateral movement if an intrusion attempt is detected.

Community reviews

Loading reviews…