IndicatorPublished 13 Feb 2026Updated 14 Feb 2026

ThreatFox IOCs for 2026-02-13

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 267

servupdt.comUnknown malware payload delivery domain (confidence level: 100%)
poritkaz.comUnknown malware payload delivery domain (confidence level: 100%)
bezelek.shopUnknown malware payload delivery domain (confidence level: 100%)
ferlik.shopUnknown malware payload delivery domain (confidence level: 100%)
berlof.shopUnknown malware payload delivery domain (confidence level: 100%)
winiks.comUnknown malware payload delivery domain (confidence level: 100%)
updtserv.comUnknown malware payload delivery domain (confidence level: 100%)
borecas.comNetSupportManager RAT botnet C2 domain (confidence level: 100%)
verolix.comNetSupportManager RAT botnet C2 domain (confidence level: 100%)
audioza.cyouLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 204

https://servupdt.com/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://bezelek.shop/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://ferlik.shop/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://berlof.shop/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://winiks.com/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://winjak.com/data.phpUnknown malware payload delivery URL (confidence level: 100%)
https://winjak.com/test.phpUnknown malware payload delivery URL (confidence level: 100%)
https://winjak.com/helpu.phpUnknown malware payload delivery URL (confidence level: 100%)
https://poritkaz.com/data.phpUnknown malware payload delivery URL (confidence level: 100%)
https://poritkaz.com/test.phpUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 250

193.58.121.235AsyncRAT botnet C2 server (confidence level: 100%)
198.46.173.21Remcos botnet C2 server (confidence level: 100%)
158.94.210.195Mirai botnet C2 server (confidence level: 100%)
158.94.210.195Mirai botnet C2 server (confidence level: 100%)
192.169.69.26Remcos botnet C2 server (confidence level: 100%)
91.92.241.159Mirai botnet C2 server (confidence level: 100%)
158.94.210.195Mirai botnet C2 server (confidence level: 80%)
185.53.179.128Lumma Stealer botnet C2 server (confidence level: 100%)
52.28.247.255NjRAT botnet C2 server (confidence level: 100%)
185.208.156.187Remcos botnet C2 server (confidence level: 100%)

Hashes 189

8e1e889e1645d03d9e9de5f742c9ae621ae14a26AsyncRAT payload (confidence level: 95%)
b1081950688c518fa94c24bac590e3c051ca4eb5aea9512fdbde010d43156589AsyncRAT payload (confidence level: 95%)
7f29a03e29a46d47e382d9b77bdcc560AsyncRAT payload (confidence level: 95%)
e421261bf9c56bc5390d1f1b5be10f4fa53ba34ctroystealer payload (confidence level: 95%)
e37c838dc5eaa1b302ffbd8721c6a5f52a068e8f78bbec63b19b950462fe6cf8troystealer payload (confidence level: 95%)
be0930fc1d862072effdd01493361fb5troystealer payload (confidence level: 95%)
6dfd567442f7443215d79faa04a0c636c48cdcb6SalatStealer payload (confidence level: 95%)
4c775aa1307cb251a5f71f04541b8458d8e351d623964c7a1eda6ab4fb0b22a2SalatStealer payload (confidence level: 95%)
02c7899b6826b2b43d64caed27de6ab0SalatStealer payload (confidence level: 95%)
2afececb753a45fee6883dfa511227e0b5dc4bebAsyncRAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-02-13

Impact

For European organizations, the impact of this threat intelligence update is primarily in the domain of improved detection and situational awareness rather than direct operational disruption. By incorporating these IOCs into security monitoring platforms such as SIEMs, IDS/IPS, and endpoint detection tools, organizations can better identify and respond to malware-related network activities and payload delivery attempts. This can reduce the dwell time of attackers and limit potential damage from malware infections. However, since no active exploits or vulnerabilities are reported, there is no immediate risk of compromise solely from this information. The medium severity rating suggests that while the threat is not critical, ignoring these IOCs could result in missed detection opportunities, especially in environments with high exposure to malware campaigns. European entities with mature cybersecurity operations stand to benefit most by integrating this intelligence into their existing workflows. Conversely, organizations lacking robust monitoring may not realize the full protective value of these IOCs. Overall, the impact is preventive and intelligence-driven, supporting proactive defense rather than reactive incident response.

Defensive guidance

1. Integrate the provided IOCs into existing security monitoring and threat detection platforms such as SIEM, IDS/IPS, and endpoint detection and response (EDR) solutions to enhance visibility of potential malware-related network activity. 2. Regularly update threat intelligence feeds and ensure automated ingestion of new IOCs to maintain current detection capabilities. 3. Conduct network traffic analysis focusing on payload delivery patterns and anomalous OSINT-related activities to identify early signs of compromise. 4. Train security operations center (SOC) personnel to recognize and investigate alerts generated by these IOCs, emphasizing correlation with other threat intelligence sources. 5. Maintain a robust incident response plan that includes procedures for handling detections triggered by these IOCs, ensuring timely containment and remediation. 6. Collaborate with information sharing communities and CERTs to exchange insights and validate the relevance of these IOCs within the European context. 7. Since no patches or direct vulnerability mitigations are available, focus on strengthening perimeter defenses, network segmentation, and endpoint hardening to reduce the attack surface. 8. Employ behavioral analytics and anomaly detection to complement IOC-based detection, capturing novel or variant malware activities not covered by static indicators.

Community reviews

Loading reviews…