IndicatorPublished 6 Feb 2026Updated 7 Feb 2026

ThreatFox IOCs for 2026-02-06

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 163

weibast.comKongTuke payload delivery domain (confidence level: 100%)
belloww.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
dinglev.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
genusgp.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
saudiab.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
ulmacea.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
madridherb.comSmartApeSG payload delivery domain (confidence level: 100%)
tyuiyuiuyuiuy.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
celikrt.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
iausyh-50115.portmap.hostUnknown malware botnet C2 domain (confidence level: 100%)

URLs 65

https://weibast.com/5m1d.jsKongTuke payload delivery URL (confidence level: 100%)
https://weibast.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
https://madridherb.com/refresh/route-deploy.phpSmartApeSG payload delivery URL (confidence level: 100%)
https://madridherb.com/refresh/token-transpiler.jsSmartApeSG payload delivery URL (confidence level: 100%)
http://77.83.199.202/tempfileSmartApeSG payload delivery URL (confidence level: 100%)
https://figaphotography.com/tempfileSmartApeSG payload delivery URL (confidence level: 100%)
https://77.83.199.202/archiveSmartApeSG payload delivery URL (confidence level: 100%)
http://102.134.48.37:8888/5kzcCobalt Strike botnet C2 (confidence level: 75%)
https://currentsystems.com/apiLumma Stealer botnet C2 (confidence level: 100%)
https://mail.binbinartgallery.com/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 121

185.221.213.13Remcos botnet C2 server (confidence level: 100%)
91.92.241.145Quasar RAT botnet C2 server (confidence level: 100%)
91.92.241.145Quasar RAT botnet C2 server (confidence level: 100%)
107.172.238.23Remcos botnet C2 server (confidence level: 100%)
45.148.18.41Remcos botnet C2 server (confidence level: 100%)
103.20.241.112XWorm botnet C2 server (confidence level: 100%)
46.101.112.70Mirai botnet C2 server (confidence level: 100%)
181.134.206.134PureRAT botnet C2 server (confidence level: 100%)
147.185.221.223XWorm botnet C2 server (confidence level: 100%)
95.214.234.165Remcos botnet C2 server (confidence level: 100%)

Hashes 2

Unknown malware payload (confidence level: 100%)

8ef869e7ed4310ddf6e2a91855c12463
d762a79258667ee965a32b2983a4339e

Description

ThreatFox IOCs for 2026-02-06

Impact

For European organizations, the impact of these IOCs is primarily in the realm of threat detection and situational awareness rather than direct compromise or operational disruption. Since no active exploits or vulnerabilities are identified, the immediate risk to confidentiality, integrity, or availability is low. However, failure to integrate these IOCs into security monitoring could result in missed early warnings of malware-related activities, potentially allowing adversaries to progress undetected in their attack lifecycle. Organizations operating critical infrastructure or handling sensitive data may face increased risk if these indicators correlate with targeted reconnaissance or payload delivery attempts. The medium severity rating suggests that while the threat is not urgent, it should be taken seriously as part of a layered defense strategy. The lack of patches or fixes means that mitigation relies on detection and response capabilities rather than vulnerability remediation.

Defensive guidance

European organizations should prioritize the integration of these ThreatFox IOCs into their existing Security Information and Event Management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools. Automated ingestion of updated IOCs will enhance the ability to detect suspicious network activity and payload delivery attempts associated with malware. Security teams should conduct regular threat hunting exercises using these indicators to identify potential early-stage compromises. Additionally, organizations should ensure robust network segmentation and strict access controls to limit the lateral movement of any malware detected. Employee awareness training on recognizing phishing and social engineering tactics remains critical, as these are common initial vectors for payload delivery. Finally, collaboration with national Computer Emergency Response Teams (CERTs) and sharing of threat intelligence within industry sectors can improve collective defense against emerging threats indicated by these IOCs.

Community reviews

Loading reviews…