IndicatorPublished 11 Feb 2026Updated 12 Feb 2026

ThreatFox IOCs for 2026-02-11

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 1,720

jorney.topSmartApeSG payload delivery domain (confidence level: 100%)
booking.fijivacations.comFAKEUPDATES payload delivery domain (confidence level: 100%)
x1eginabraz1985bk.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
infra.permianbuildersllc.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
rmtino009.accesscam.orgRemcos botnet C2 domain (confidence level: 100%)
x1esalwanazeeze.ddns.netRemcos botnet C2 domain (confidence level: 100%)
semadaneepo.beget.appChaos botnet C2 domain (confidence level: 100%)
gateway001kir.comEtherRAT botnet C2 domain (confidence level: 100%)
mymexico.socialEtherRAT botnet C2 domain (confidence level: 100%)
api-gateway-prod.comEtherRAT botnet C2 domain (confidence level: 100%)

URLs 29

https://jorney.top/signin/endpoint-effect.jsSmartApeSG payload delivery URL (confidence level: 100%)
https://jorney.top/signin/settings-sandbox.phpSmartApeSG payload delivery URL (confidence level: 100%)
https://jorney.top/signin/metrics-layout.jsSmartApeSG payload delivery URL (confidence level: 100%)
https://007consultoriafinanceira.club/tas/receptor.phpUnknown malware botnet C2 (confidence level: 100%)
http://endlessgrumbler.cc:8080/updater?for=0aa6b9f07a5b27b2069c137c69ec91ebUnknown malware botnet C2 (confidence level: 100%)
https://chuckyr.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
http://193.58.121.25/8b0d6900a357439d.phpStealc botnet C2 (confidence level: 100%)
https://78.46.161.30/Vidar botnet C2 (confidence level: 100%)
https://65.109.252.134/Vidar botnet C2 (confidence level: 100%)
https://46.224.178.22/Vidar botnet C2 (confidence level: 100%)

IP addresses 153

45.88.186.98XWorm botnet C2 server (confidence level: 100%)
147.185.221.31XWorm botnet C2 server (confidence level: 100%)
178.16.53.27Quasar RAT botnet C2 server (confidence level: 100%)
185.196.11.16Remcos botnet C2 server (confidence level: 100%)
94.156.68.149Remcos botnet C2 server (confidence level: 100%)
170.130.55.99XWorm botnet C2 server (confidence level: 100%)
8.148.77.56Cobalt Strike botnet C2 server (confidence level: 100%)
192.159.99.248Remcos botnet C2 server (confidence level: 100%)
192.159.99.158Remcos botnet C2 server (confidence level: 100%)
193.26.115.183AsyncRAT botnet C2 server (confidence level: 100%)

Hashes 5

637d7b92325a8894dd96f94fc063fe17Unknown malware payload (confidence level: 100%)
8be360adff9b391c67c832208c6660f8Unknown malware payload (confidence level: 100%)
a454720443d664bcdf4d706b7441d2a2WarLock payload (confidence level: 100%)
fa87ddcd230406057eb1163cee722fceWarLock payload (confidence level: 100%)
3c38b722623d5ea9af0098ec93748cb0bc4af3405d6715b574fffe119f755f18Unknown Stealer payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-02-11

Impact

For European organizations, the impact of this threat is primarily in the domain of threat detection and intelligence enrichment rather than direct compromise. The medium severity rating suggests that while the threat does not currently exploit vulnerabilities or cause direct damage, failure to incorporate these IOCs into security monitoring could result in missed detection of malware payload delivery attempts or network-based malicious activity. Organizations with mature security operations centers (SOCs) and threat hunting capabilities will benefit most from integrating this intelligence, potentially reducing dwell time of attackers and improving incident response. Conversely, entities lacking robust monitoring may remain blind to emerging malware campaigns that utilize similar tactics. The absence of patches or known exploits means that the threat does not currently pose a direct risk to system confidentiality, integrity, or availability but could facilitate early warning of malicious activity. European critical infrastructure and sectors with high-value data could indirectly face increased risk if such intelligence is not leveraged effectively.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection capabilities. 2. Regularly update threat intelligence feeds and ensure automated ingestion of new IOCs to maintain current situational awareness. 3. Conduct proactive threat hunting exercises focusing on payload delivery mechanisms and suspicious network activity patterns highlighted by these IOCs. 4. Enhance network segmentation and monitoring to limit potential lateral movement if malware payloads are detected. 5. Train SOC analysts to recognize behaviors associated with the indicators and to escalate suspicious findings promptly. 6. Collaborate with national and European cybersecurity information sharing organizations to exchange intelligence and best practices. 7. Maintain robust incident response plans that incorporate the use of OSINT and IOCs for rapid containment and remediation. These steps go beyond generic advice by emphasizing operational integration of the specific intelligence and collaborative defense.

Community reviews

Loading reviews…