IndicatorPublished 10 Feb 2026Updated 11 Feb 2026

ThreatFox IOCs for 2026-02-10

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 59

mirai.k4ss.lolMirai botnet C2 domain (confidence level: 100%)
www.slimcaseglobalservices.comRemcos botnet C2 domain (confidence level: 100%)
www.slimcaseglobalservicesbackup1.comRemcos botnet C2 domain (confidence level: 100%)
www.slimcaseglobalservicesbackup2.comRemcos botnet C2 domain (confidence level: 100%)
wacuzi.dezanatop.infoRemcos botnet C2 domain (confidence level: 100%)
sukarvs8i.dezanatop.infoRemcos botnet C2 domain (confidence level: 100%)
autosalestallahasseefl.comUnknown Stealer botnet C2 domain (confidence level: 100%)
orlandoremodelingcompany.comUnknown Stealer botnet C2 domain (confidence level: 100%)
hostjnger.comUnknown Stealer botnet C2 domain (confidence level: 100%)
oly.emiraride.comVidar botnet C2 domain (confidence level: 100%)

URLs 20

http://www.ttghk.com/malyka/panel/gate.phpPony botnet C2 (confidence level: 100%)
https://74.0.48.35/Vidar botnet C2 (confidence level: 100%)
https://46.225.107.186/Vidar botnet C2 (confidence level: 100%)
https://46.225.95.6/Vidar botnet C2 (confidence level: 100%)
https://oly.emiraride.com/Vidar botnet C2 (confidence level: 100%)
https://oly.megaexdistribuidora.com.br/Vidar botnet C2 (confidence level: 100%)
https://spk.emiraride.com/Vidar botnet C2 (confidence level: 100%)
https://spk.megaexdistribuidora.com.br/Vidar botnet C2 (confidence level: 100%)
http://91.92.243.29/bnodaPhorpiex payload delivery URL (confidence level: 100%)
https://retiroreturn.com/signin/settings-sandbox.phpSmartApeSG payload delivery URL (confidence level: 100%)

IP addresses 123

217.138.212.53Remcos botnet C2 server (confidence level: 100%)
104.37.174.26Remcos botnet C2 server (confidence level: 100%)
34.145.0.194XWorm botnet C2 server (confidence level: 100%)
88.156.30.96Mirai botnet C2 server (confidence level: 100%)
177.197.71.229Mirai botnet C2 server (confidence level: 100%)
43.243.191.231Cobalt Strike botnet C2 server (confidence level: 100%)
47.82.7.142GobRAT botnet C2 server (confidence level: 100%)
93.232.99.171NetSupportManager RAT botnet C2 server (confidence level: 100%)
3.112.13.90Meterpreter botnet C2 server (confidence level: 100%)
16.26.193.159Meterpreter botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-02-10

Impact

For European organizations, the impact of this threat intelligence is primarily in enhancing detection and response capabilities rather than mitigating an immediate risk. Since no specific vulnerabilities or exploits are identified, the direct impact on confidentiality, integrity, or availability is limited at this stage. However, the presence of IOCs related to malware payload delivery and network activity indicates potential risks if these indicators correspond to active or emerging threats. Organizations that fail to incorporate such intelligence into their security operations may miss early signs of compromise, leading to delayed detection and increased damage from malware infections. The medium severity rating suggests that while the threat is not critical, it warrants attention to prevent escalation. European entities with extensive network infrastructure and reliance on OSINT for threat hunting will benefit most from integrating this data. The proactive use of these IOCs can reduce dwell time of attackers and limit the scope of potential breaches. Conversely, organizations lacking mature threat intelligence capabilities may find it challenging to operationalize this information effectively, potentially increasing their exposure.

Defensive guidance

To effectively leverage this threat intelligence, European organizations should: 1) Integrate the provided IOCs into Security Information and Event Management (SIEM) systems and Endpoint Detection and Response (EDR) tools to enable automated detection of related malicious activity. 2) Enhance network monitoring to identify unusual payload delivery patterns and suspicious network traffic consistent with the indicators. 3) Conduct regular threat hunting exercises using the OSINT and network activity indicators to proactively identify potential compromises. 4) Share relevant findings with national Computer Security Incident Response Teams (CSIRTs) and industry Information Sharing and Analysis Centers (ISACs) to improve collective defense. 5) Maintain updated incident response plans that incorporate procedures for handling malware infections indicated by these IOCs. 6) Train security analysts on interpreting and applying OSINT-based threat intelligence to maximize the utility of such feeds. 7) Employ network segmentation and strict access controls to limit the spread of malware if detected. These measures go beyond generic advice by focusing on operationalizing the specific intelligence provided and fostering collaboration within the European cybersecurity community.

Community reviews

Loading reviews…