IndicatorPublished 5 Feb 2026Updated 6 Feb 2026

ThreatFox IOCs for 2026-02-05

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 203

mezcalpro.comSmartApeSG payload delivery domain (confidence level: 100%)
socialitei.comSmartApeSG payload delivery domain (confidence level: 100%)
08f0.proxy-edge-c5f.workers.devSMOKEDHAM botnet C2 domain (confidence level: 100%)
divine-glitter-cfb4.elena-morales.workers.devSMOKEDHAM botnet C2 domain (confidence level: 100%)
little-frog-2e65.kaxij51156.workers.devSMOKEDHAM botnet C2 domain (confidence level: 100%)
app-server.comof72509.workers.devSMOKEDHAM botnet C2 domain (confidence level: 100%)
dev1-server.sogal69343.workers.devSMOKEDHAM botnet C2 domain (confidence level: 100%)
erberloose.clubStealc botnet C2 domain (confidence level: 100%)
whreceiver.ruUnknown malware botnet C2 domain (confidence level: 100%)
filegrace2026.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)

URLs 182

https://mezcalpro.com/scqSmartApeSG payload delivery URL (confidence level: 100%)
https://socialitei.com/callback/logout-payload.jsSmartApeSG payload delivery URL (confidence level: 100%)
https://socialitei.com/callback/proxy-parser.phpSmartApeSG payload delivery URL (confidence level: 100%)
https://socialitei.com/callback/refresh-parser.jsSmartApeSG payload delivery URL (confidence level: 100%)
http://193.42.38.38/funcSmartApeSG payload delivery URL (confidence level: 100%)
https://neymbus.com/funcSmartApeSG payload delivery URL (confidence level: 100%)
https://193.42.38.38/classSmartApeSG payload delivery URL (confidence level: 100%)
https://captoolsz.com/Unknown malware payload delivery URL (confidence level: 90%)
https://support.asseryassin.com/Unknown malware payload delivery URL (confidence level: 90%)
http://wp-filemanager.com/mshell_cred.jsonUnknown malware botnet C2 (confidence level: 100%)

IP addresses 285

194.113.106.125PureRAT botnet C2 server (confidence level: 100%)
91.92.242.13Mirai botnet C2 server (confidence level: 100%)
93.116.248.13Latrodectus botnet C2 server (confidence level: 100%)
109.202.111.2Latrodectus botnet C2 server (confidence level: 100%)
104.238.205.20Latrodectus botnet C2 server (confidence level: 100%)
5.101.86.66Remcos botnet C2 server (confidence level: 100%)
46.246.34.53Remcos botnet C2 server (confidence level: 100%)
37.77.150.117Stealc botnet C2 server (confidence level: 50%)
95.85.237.193Stealc botnet C2 server (confidence level: 50%)
146.103.127.46Stealc botnet C2 server (confidence level: 50%)

Hashes 26

b992e880fce09d09bd2ed7a172c592a20e211f31a116911174f20ac98b818cb0Mekotio payload (confidence level: 25%)
045d1e0686f8b4b49b2d9cf48ac821f8Unknown malware payload (confidence level: 75%)
0df3fde016f3c0974d4aa01b06724a33Unknown malware payload (confidence level: 75%)
1550ae7df233bb9a9c9e78bf8b236072Unknown malware payload (confidence level: 75%)
2f7b4dca1c79e525aef8da537294a6c4Unknown malware payload (confidence level: 75%)
337cecf067ecf0609b943b54fb246ed2Unknown malware payload (confidence level: 75%)
41c51784f6d601ffd0e09b7d59ff6025Unknown malware payload (confidence level: 75%)
4727582023cd8071a6f388ea3ba2feaaUnknown malware payload (confidence level: 75%)
58f517bdc9ba8de1b69829b0dcf86113Unknown malware payload (confidence level: 75%)
6408276cdfd12a1d5d3ed7256bfba639Unknown malware payload (confidence level: 75%)

Description

ThreatFox IOCs for 2026-02-05

Impact

For European organizations, the potential impact of this threat is moderate but should not be underestimated. The malware's focus on payload delivery and network activity could lead to unauthorized access, data exfiltration, or disruption of services if successfully deployed. Given the lack of specific affected products or versions, the threat likely targets common network infrastructure or widely used software components, which could affect a broad range of organizations. The absence of known exploits in the wild reduces immediate risk but does not eliminate the possibility of future exploitation or targeted attacks. European entities involved in critical infrastructure, government, or industries with high reliance on OSINT and networked systems may face increased exposure. The medium severity rating reflects a balanced risk profile where confidentiality, integrity, and availability could be impacted if the malware is deployed effectively. Organizations may experience operational disruptions, data breaches, or reputational damage if defenses are insufficient.

Defensive guidance

To mitigate this threat effectively, European organizations should implement the following specific measures: 1) Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection capabilities. 2) Conduct regular network traffic analysis to identify anomalous payload delivery attempts or unusual network activity patterns associated with malware. 3) Employ threat intelligence sharing platforms to stay updated on evolving indicators and tactics related to this threat. 4) Harden network perimeter defenses by enforcing strict segmentation and limiting unnecessary external communications to reduce attack surface. 5) Implement robust endpoint detection and response (EDR) solutions capable of identifying and isolating suspicious payloads. 6) Conduct targeted user awareness training focusing on recognizing phishing or social engineering attempts that could facilitate payload delivery. 7) Maintain up-to-date backups and incident response plans tailored to malware containment and eradication. 8) Collaborate with national cybersecurity centers and CERTs to receive timely alerts and guidance relevant to this threat. These measures go beyond generic advice by emphasizing integration of specific IOCs, network behavior analysis, and coordinated intelligence sharing.

Community reviews

Loading reviews…