IndicatorPublished 14 Feb 2026Updated 15 Feb 2026

ThreatFox IOCs for 2026-02-14

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 113

cpanel.terriberrynj.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
cyrex.ccVidar payload delivery domain (confidence level: 100%)
displaysecurity.comIClickFix botnet C2 domain (confidence level: 75%)
fxplay.inIClickFix botnet C2 domain (confidence level: 75%)
liveworkplaylkn.comIClickFix botnet C2 domain (confidence level: 75%)
ranchernandez.storeIClickFix botnet C2 domain (confidence level: 75%)
sportsstories.grIClickFix botnet C2 domain (confidence level: 75%)
constructora-alpigroup.comIClickFix botnet C2 domain (confidence level: 75%)
territoriodoagro.comIClickFix botnet C2 domain (confidence level: 75%)
thewigdoctorshop.comIClickFix botnet C2 domain (confidence level: 75%)

URLs 7

https://74.0.48.100/Vidar botnet C2 (confidence level: 100%)
http://91.196.33.68Stealc botnet C2 (confidence level: 100%)
https://brekaz.shop/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://portuge.cyou/apiLumma Stealer botnet C2 (confidence level: 75%)
https://drawnbe.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
http://endlessgrumbler.cc:8080/updater?for=365bcb25a26273ddb4f98d8d4b16a4c2Unknown malware botnet C2 (confidence level: 100%)
http://144.31.139.187Stealc botnet C2 (confidence level: 75%)

IP addresses 124

185.177.57.70Mirai botnet C2 server (confidence level: 88%)
85.120.81.158Mirai botnet C2 server (confidence level: 100%)
104.156.155.94Unknown malware botnet C2 server (confidence level: 100%)
156.247.41.106Ghost RAT botnet C2 server (confidence level: 77%)
124.198.132.104Stealc botnet C2 server (confidence level: 100%)
64.190.113.206MintsLoader payload delivery server (confidence level: 100%)
43.228.157.33Mirai botnet C2 server (confidence level: 80%)
144.172.105.225SystemBC botnet C2 server (confidence level: 100%)
141.94.23.83XWorm botnet C2 server (confidence level: 100%)
54.38.55.91XWorm botnet C2 server (confidence level: 100%)

Hashes 7

Unknown malware payload (confidence level: 100%)

510a87871053e239479f28101f013d0f
0ec7d167c7ee8764e21c792d6a65d059
fb42dec2c39cd7884ca4cb6b76308f51
370fbcc6711fb983ae4679f02c5ac461
29144c2f5acd859adf08d42ffcd74f50
0f7d721e4e5e2ce0a5c629f2fd4ac572
e80e683b7d37acd47afa66919145ecf4

Description

ThreatFox IOCs for 2026-02-14

Impact

For European organizations, the impact of this threat is currently limited due to the lack of active exploitation and specific targeting information. However, the potential for payload delivery through network activity means that if leveraged, it could lead to unauthorized access, data exfiltration, or disruption of services. Organizations relying heavily on OSINT tools or exposed network services should be vigilant. The medium severity suggests a moderate risk to confidentiality and integrity if the malware payloads are successfully delivered and executed. Availability impact appears minimal at this stage. Since no patches or direct mitigations are available, the primary impact is on detection and response capabilities. Failure to incorporate these IOCs into security monitoring could delay identification of related malicious activity, increasing risk exposure. Overall, the threat underscores the importance of proactive threat intelligence integration and network monitoring within European enterprises.

Defensive guidance

European organizations should integrate the provided IOCs from the ThreatFox feed into their security information and event management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enhance detection capabilities. Regularly update threat intelligence feeds and correlate alerts with network traffic to identify potential payload delivery attempts. Conduct thorough network segmentation to limit lateral movement if a payload is delivered. Employ strict egress filtering and monitor outbound traffic for anomalies. Maintain up-to-date endpoint protection with behavioral analysis to detect unknown malware payloads. Since no patches are available, focus on hardening network perimeters, enforcing least privilege access, and conducting regular security awareness training to reduce the risk of social engineering or phishing that could facilitate payload delivery. Additionally, perform periodic threat hunting exercises using the latest OSINT indicators to identify early signs of compromise. Collaborate with national and European cybersecurity centers to share intelligence and receive timely updates.

Community reviews

Loading reviews…