IndicatorPublished 7 Feb 2026Updated 8 Feb 2026

ThreatFox IOCs for 2026-02-07

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 151

methet.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
x1emethet.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
old.fijitravel.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
folder-cloud-processor-core.in.netClearFake payload delivery domain (confidence level: 100%)
fc.yahoos.liveUnknown malware botnet C2 domain (confidence level: 100%)
macoblique.comUnknown Stealer payload delivery domain (confidence level: 100%)
filetransferdock51.comUnknown Stealer payload delivery domain (confidence level: 100%)
csp.yahoos.liveUnknown malware botnet C2 domain (confidence level: 100%)
hoathinh3d.bzAsyncRAT botnet C2 domain (confidence level: 100%)
phil.ns.cloudflare.comAsyncRAT botnet C2 domain (confidence level: 100%)

URLs 34

https://cyberplg.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
https://makeravh.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
http://9958850.com/apiLumma Stealer botnet C2 (confidence level: 100%)
https://coverxyzer.su/vvvfdvLumma Stealer botnet C2 (confidence level: 100%)
https://hanggxx.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
https://mecholuq.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
https://canonjo.asia/apiLumma Stealer botnet C2 (confidence level: 100%)
https://vetchir.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
https://tragedj.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
https://braxttp.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 168

45.74.8.75Remcos botnet C2 server (confidence level: 100%)
213.152.162.116AdWind botnet C2 server (confidence level: 100%)
47.104.213.88XWorm botnet C2 server (confidence level: 100%)
47.109.65.22Sliver botnet C2 server (confidence level: 100%)
212.193.31.199SectopRAT botnet C2 server (confidence level: 100%)
102.98.89.28NetSupportManager RAT botnet C2 server (confidence level: 100%)
94.237.96.207MimiKatz botnet C2 server (confidence level: 100%)
202.191.67.71AdaptixC2 botnet C2 server (confidence level: 100%)
13.232.185.41Meterpreter botnet C2 server (confidence level: 100%)
196.75.27.139Meterpreter botnet C2 server (confidence level: 100%)

Hashes 186

1cf6892560e0fe5fd9cd18d5a57c46468cdd92eeNjRAT payload (confidence level: 95%)
7b739b1ecfd76e94cd22186b0778b0797f193a2a52f459acb0fe9a5176ec000bNjRAT payload (confidence level: 95%)
2d1c955c6f44d70985fb7ea0f85ace73NjRAT payload (confidence level: 95%)
048dc9d7a7ccc1972d9076f59b404071928cdf29SalatStealer payload (confidence level: 95%)
9fa404ae52de527e89d8ee0927d4246222db2568929a9560f924c4e58cb9ff26SalatStealer payload (confidence level: 95%)
c887137dc9e83d967fd63797138639f2SalatStealer payload (confidence level: 95%)
0f18250232cba885b4e2f96eed67a3e1ed206b65SalatStealer payload (confidence level: 95%)
a30940760fe0de1c84ec8452d2af1aa23dea47a483b7eb3e655952bab0a75ef2SalatStealer payload (confidence level: 95%)
bd46bc1317878c321f72d9a75b71c1d9SalatStealer payload (confidence level: 95%)
f5299e11c85b1a5d14e7c1285485025fbe688529MetaStealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-02-07

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing detection and situational awareness rather than indicating an immediate risk of compromise. Since no specific vulnerabilities or exploits are identified, the direct impact on confidentiality, integrity, or availability is limited. However, the presence of malware-related IOCs related to network activity and payload delivery suggests that organizations could be targeted by malware campaigns leveraging these indicators. If unmonitored, such activity could lead to data breaches, system compromise, or disruption. The medium severity rating reflects a moderate risk level, emphasizing the importance of integrating this intelligence into existing security operations to prevent potential escalation. Organizations with critical infrastructure or sensitive data may face higher risks if these IOCs correspond to malware targeting their sectors. Overall, the impact is contingent on the organization's ability to detect and respond to the threat using the provided intelligence.

Defensive guidance

European organizations should incorporate the provided IOCs into their security monitoring and threat hunting processes, updating intrusion detection systems (IDS), endpoint detection and response (EDR) tools, and network security appliances accordingly. Given the lack of specific patch information, focus should be on enhancing network traffic analysis to identify suspicious payload delivery attempts and anomalous communications. Implementing robust network segmentation and strict egress filtering can limit malware propagation and command and control communications. Regularly updating threat intelligence feeds and correlating them with internal logs will improve detection accuracy. Security teams should also conduct proactive hunting for related indicators within their environments and validate alerts promptly. Employee awareness and phishing prevention remain critical, as payload delivery often involves social engineering. Finally, maintaining comprehensive incident response plans and backup strategies will mitigate potential impacts if malware is detected.

Community reviews

Loading reviews…