IndicatorPublished 4 Feb 2026Updated 5 Feb 2026

ThreatFox IOCs for 2026-02-04

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 86

plesk.cheriwildes.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
manymencresless.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
wariorsdontquits.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
x1ewariorsdontquits.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
6s6sv4oisuhjtetpmfcbszz.kicks-ass.netRemcos botnet C2 domain (confidence level: 100%)
zoro012355.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
x1ezoro012355.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
true-baghdad.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
botnet.lokifisch.devQuasar RAT botnet C2 domain (confidence level: 100%)
cow-swap.coUnknown malware botnet C2 domain (confidence level: 75%)

URLs 30

https://cdn.jsdelivr.net/gh/stp26det/22/getClearFake payload delivery URL (confidence level: 100%)
http://172.233.15.195:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://185.250.148.227/RedLine Stealer botnet C2 (confidence level: 100%)
http://102.204.223.168:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://185.242.233.142:7877/jquery-3.3.1.min.jsCobalt Strike botnet C2 (confidence level: 75%)
https://cdn.jsdelivr.net/gh/keys53/c10ud/nmbr9ClearFake payload delivery URL (confidence level: 100%)
http://178.16.52.35/c8ed5c2a04a04ed6.phpStealc botnet C2 (confidence level: 100%)
http://89.110.107.177:9000/wmglbSectopRAT botnet C2 (confidence level: 100%)
http://89.110.107.177:9000/wbinjgetSectopRAT botnet C2 (confidence level: 100%)
http://77.110.121.209:5000/api/beatXillen Stealer botnet C2 (confidence level: 100%)

IP addresses 126

185.242.3.144Mirai botnet C2 server (confidence level: 100%)
143.14.44.149XWorm botnet C2 server (confidence level: 100%)
23.94.252.26Stealc botnet C2 server (confidence level: 50%)
31.57.219.190Stealc botnet C2 server (confidence level: 50%)
31.129.22.98Stealc botnet C2 server (confidence level: 50%)
64.89.161.41Stealc botnet C2 server (confidence level: 50%)
79.133.46.139Stealc botnet C2 server (confidence level: 50%)
80.78.31.191Stealc botnet C2 server (confidence level: 50%)
83.217.208.134Stealc botnet C2 server (confidence level: 50%)
85.137.253.36Stealc botnet C2 server (confidence level: 50%)

Description

ThreatFox IOCs for 2026-02-04

Impact

For European organizations, this threat could lead to unauthorized network access or malware infections through payload delivery mechanisms informed by OSINT techniques. The impact on confidentiality, integrity, and availability could be moderate if successful payload delivery leads to data exfiltration, system compromise, or disruption of services. Organizations heavily reliant on networked infrastructure and OSINT tools may be more vulnerable, especially if they lack robust network monitoring and threat intelligence capabilities. The absence of known exploits reduces immediate risk, but the potential for emerging exploitation means that organizations could face increased attack attempts over time. The medium severity suggests that while the threat is not critical, it could still cause operational disruptions or data breaches if not addressed. European entities involved in critical infrastructure, finance, or government sectors may be particularly sensitive to such threats due to the strategic value of their data and systems.

Defensive guidance

European organizations should implement enhanced network monitoring to detect unusual or suspicious network activity that could indicate payload delivery attempts. Integrating updated threat intelligence feeds, including ThreatFox and other OSINT sources, will improve detection capabilities. Employ network segmentation and strict access controls to limit the spread of any potential malware payloads. Conduct regular security awareness training focused on recognizing social engineering and phishing attempts that could be used to deliver payloads. Employ endpoint detection and response (EDR) solutions capable of identifying and blocking unknown or suspicious payloads. Since no patches are available, focus on hardening network perimeter defenses, including firewalls, intrusion detection/prevention systems (IDS/IPS), and secure configuration of exposed services. Regularly review and update incident response plans to ensure rapid containment and remediation if an infection occurs. Collaborate with national and European cybersecurity centers to share intelligence and receive timely alerts about emerging threats.

Community reviews

Loading reviews…