IndicatorPublished 12 Feb 2026Updated 13 Feb 2026

ThreatFox IOCs for 2026-02-12

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 426

hubjimfoodsales.shopUnknown RAT botnet C2 domain (confidence level: 100%)
futureentrepreneurhub.comUnknown RAT botnet C2 domain (confidence level: 75%)
blazingtigerpower.comUnknown RAT botnet C2 domain (confidence level: 75%)
stormfurycommandhqex.comUnknown RAT botnet C2 domain (confidence level: 75%)
netrovalixsystems.comUnknown RAT botnet C2 domain (confidence level: 75%)
silverlilysummer.comUnknown RAT botnet C2 domain (confidence level: 75%)
energyefficienttools.comUnknown RAT botnet C2 domain (confidence level: 75%)
administrator.corepulseworks.comUnknown RAT botnet C2 domain (confidence level: 75%)
primeaiinfrastructure.comUnknown RAT botnet C2 domain (confidence level: 75%)
nexustelecomltd.comUnknown RAT botnet C2 domain (confidence level: 75%)

URLs 34

http://64.188.79.242/installerr/api/endpoint.phpAmadey botnet C2 (confidence level: 100%)
https://captioz.shop/Unknown malware payload delivery URL (confidence level: 90%)
http://nonny11.xyz/sol/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
https://saborizerefeicoes34.store/donldpats/receptor.phpUnknown malware botnet C2 (confidence level: 100%)
https://gts.emiraride.com/Vidar botnet C2 (confidence level: 100%)
https://gts.megaexdistribuidora.com.br/Vidar botnet C2 (confidence level: 100%)
https://mtg.emiraride.com/Vidar botnet C2 (confidence level: 100%)
https://mtg.megaexdistribuidora.com.br/Vidar botnet C2 (confidence level: 100%)
https://89.167.68.164/Vidar botnet C2 (confidence level: 100%)
https://65.109.252.105/Vidar botnet C2 (confidence level: 100%)

IP addresses 112

38.134.148.152Unknown RAT botnet C2 server (confidence level: 100%)
91.160.139.68XWorm botnet C2 server (confidence level: 100%)
45.88.186.98XWorm botnet C2 server (confidence level: 100%)
198.244.201.139XWorm botnet C2 server (confidence level: 100%)
90.0.231.39XWorm botnet C2 server (confidence level: 100%)
82.102.23.139Remcos botnet C2 server (confidence level: 100%)
185.208.156.187Remcos botnet C2 server (confidence level: 100%)
147.185.221.31Remcos botnet C2 server (confidence level: 100%)
173.211.46.215Unknown RAT botnet C2 server (confidence level: 100%)
34.88.31.95Sliver botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-02-12

Impact

For European organizations, the primary impact of this threat lies in the potential for network-based malware payload delivery, which could lead to unauthorized access, data exfiltration, or disruption of services if successfully executed. Since no specific software vulnerabilities are identified, the risk is more about exposure to malicious network traffic and the ability to detect and respond to it. Organizations heavily reliant on networked infrastructure, especially those involved in critical sectors such as finance, energy, and government, could face increased risk if their network defenses are insufficient. The lack of known exploits in the wild reduces immediate urgency but does not eliminate the risk of future exploitation attempts. The medium severity rating suggests that while the threat is not critical, it warrants attention to prevent escalation. Failure to detect or mitigate such payload delivery attempts could result in compromise of confidentiality, integrity, and availability of systems and data.

Defensive guidance

European organizations should integrate the ThreatFox IOCs into their existing security information and event management (SIEM) systems and threat intelligence platforms to enhance detection capabilities. Network segmentation should be enforced to limit the lateral movement potential of any delivered payloads. Regular network traffic analysis and anomaly detection can help identify suspicious activities related to payload delivery. Endpoint detection and response (EDR) tools should be configured to monitor for unusual behaviors consistent with malware execution. Since no patches are available, emphasis should be placed on proactive threat hunting and incident response readiness. Security teams should also ensure that OSINT and threat intelligence feeds are continuously updated and correlated with internal logs. User training on recognizing phishing or social engineering attempts remains important, even though user interaction is not explicitly required here, as payload delivery often involves initial compromise vectors. Finally, collaboration with national cybersecurity centers and sharing of threat intelligence can improve collective defense.

Community reviews

Loading reviews…