IndicatorPublished 8 Feb 2026Updated 9 Feb 2026

ThreatFox IOCs for 2026-02-08

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 45

dusty-comet-jazz.comSantaStealer botnet C2 domain (confidence level: 100%)
hdl.re-v.co.idVidar botnet C2 domain (confidence level: 100%)
heysilentpanel.onrender.comUnknown Stealer botnet C2 domain (confidence level: 100%)
network-sync-protocol.netUnknown Stealer botnet C2 domain (confidence level: 100%)
connect.kedi.lolUnknown Stealer botnet C2 domain (confidence level: 100%)
robl0x.work.gdUnknown malware botnet C2 domain (confidence level: 100%)
dd.lumibiki.xyzMirai botnet C2 domain (confidence level: 100%)
frame-donut.infoSantaStealer botnet C2 domain (confidence level: 100%)
th3hunt3r-48288.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
entershopst.ru.comAsyncRAT botnet C2 domain (confidence level: 100%)

URLs 8

https://116.203.14.212/Vidar botnet C2 (confidence level: 100%)
https://46.62.225.178/Vidar botnet C2 (confidence level: 100%)
http://165.232.165.152:8080/xoner.shUnknown malware payload delivery URL (confidence level: 75%)
https://74.0.48.145/Vidar botnet C2 (confidence level: 100%)
https://dinglev.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
http://185.174.133.12/98926703060a4fbf.phpStealc botnet C2 (confidence level: 100%)
https://logicmesh.pro/api/bot/heartbeatUnknown Stealer botnet C2 (confidence level: 100%)
http://192.168.226.132:18088/tjm2Cobalt Strike botnet C2 (confidence level: 75%)

IP addresses 176

89.243.54.145XWorm botnet C2 server (confidence level: 100%)
103.252.116.60Mirai botnet C2 server (confidence level: 80%)
51.79.142.142Mirai botnet C2 server (confidence level: 100%)
46.175.167.158Remcos botnet C2 server (confidence level: 100%)
146.70.226.138DCRat botnet C2 server (confidence level: 100%)
93.171.44.221XWorm botnet C2 server (confidence level: 100%)
193.58.121.74XWorm botnet C2 server (confidence level: 100%)
2.56.165.13XWorm botnet C2 server (confidence level: 100%)
83.168.95.235Mirai botnet C2 server (confidence level: 80%)
8.148.29.29XWorm botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-02-08

Impact

For European organizations, the primary impact of this threat lies in the potential for malware payload delivery through network activity, which could lead to unauthorized access, data exfiltration, or disruption if exploited. Although no active exploits are currently known, the presence of IOCs in OSINT feeds suggests that threat actors may be preparing or conducting reconnaissance activities. Organizations with extensive network infrastructure or those in critical sectors such as finance, government, and telecommunications could be targeted for initial access or lateral movement. The medium severity indicates a moderate risk level, emphasizing the importance of vigilance but not signaling an immediate crisis. The lack of patches means that defensive measures must rely on detection and response capabilities rather than remediation of a vulnerability. Failure to monitor and act on these IOCs could result in delayed detection of intrusion attempts or malware infections, potentially impacting confidentiality, integrity, and availability of systems.

Defensive guidance

1. Integrate ThreatFox IOCs into existing Security Information and Event Management (SIEM) and intrusion detection systems to enhance detection capabilities. 2. Conduct regular network traffic analysis to identify unusual payload delivery attempts or suspicious network activity aligned with the shared IOCs. 3. Employ endpoint detection and response (EDR) tools to monitor for malware behaviors consistent with the threat profile. 4. Maintain up-to-date threat intelligence feeds and ensure security teams are trained to interpret and act on OSINT data. 5. Implement network segmentation to limit the potential spread of malware if payload delivery is successful. 6. Conduct phishing awareness and social engineering training to reduce the risk of initial compromise vectors. 7. Establish incident response playbooks that incorporate OSINT-derived indicators for rapid containment and remediation. 8. Collaborate with national and European cybersecurity centers to share intelligence and coordinate defenses against emerging threats.

Community reviews

Loading reviews…