IndicatorPublished 15 Feb 2026Updated 16 Feb 2026

ThreatFox IOCs for 2026-02-15

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 136

hanano-63144.portmap.hostAsyncRAT botnet C2 domain (confidence level: 100%)
helpmeporkogpeimeoptimize.dynuddns.comAsyncRAT botnet C2 domain (confidence level: 100%)
gramskate.ddns.netXWorm botnet C2 domain (confidence level: 100%)
ynhasmi-46863.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
gramskate.camdvr.orgXWorm botnet C2 domain (confidence level: 100%)
remcos5050.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
cdn7.mondlicht.couponsClearFake payload delivery domain (confidence level: 100%)
de-partner-node.mondlicht.couponsClearFake payload delivery domain (confidence level: 100%)
app.terrepure.couponsClearFake payload delivery domain (confidence level: 100%)
support.eztechnj.comFAKEUPDATES botnet C2 domain (confidence level: 100%)

URLs 46

https://benefitsonlineportal.com/apiLumma Stealer botnet C2 (confidence level: 100%)
https://editorr.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
https://backsan.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
https://api.telegram.org/bot8507720456:aaepnovgcyydxm2d0jemo6am4qpyh0fi2x0/sendmessageAsyncRAT botnet C2 (confidence level: 100%)
https://api.telegram.org/bot8232514058:aaecwvt9fizcz81ikw8kyznobvgjujjblg0/sendmessageAsyncRAT botnet C2 (confidence level: 100%)
http://192.30.242.54Stealc botnet C2 (confidence level: 100%)
http://91.244.70.130Stealc botnet C2 (confidence level: 100%)
http://89.169.12.176Stealc botnet C2 (confidence level: 100%)
http://91.92.34.196Stealc botnet C2 (confidence level: 100%)
https://ziziphe.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 238

147.185.221.31Quasar RAT botnet C2 server (confidence level: 100%)
79.139.173.100AsyncRAT botnet C2 server (confidence level: 100%)
39.109.116.99ValleyRAT botnet C2 server (confidence level: 100%)
202.61.160.203ValleyRAT botnet C2 server (confidence level: 100%)
8.219.177.83ValleyRAT botnet C2 server (confidence level: 100%)
192.229.116.171ValleyRAT botnet C2 server (confidence level: 100%)
192.229.116.171ValleyRAT botnet C2 server (confidence level: 100%)
125.208.23.7ValleyRAT botnet C2 server (confidence level: 100%)
143.20.185.59Mirai botnet C2 server (confidence level: 100%)
23.146.184.77Unknown malware botnet C2 server (confidence level: 100%)

Hashes 153

1ad5a2baf2e0cb70d58451441511d6c0f860cc47NjRAT payload (confidence level: 95%)
25411e3f056d4be6cee0033da6208f661c9566c50022d5be81dbcab13fe5c240NjRAT payload (confidence level: 95%)
15b0aee052abb740592de1672ed7cff8NjRAT payload (confidence level: 95%)
4f821aa92192ee4347793377540d6387ed39bcb2PeddleCheap payload (confidence level: 95%)
a79be0c9d7fc78d869fd3cd858dc90bc544c81cba74b29bcb461db8b32d6dfeePeddleCheap payload (confidence level: 95%)
bf7419f94145568e17677e9c8da0e2cbPeddleCheap payload (confidence level: 95%)
2abf4112f132c999540d9e17938f49d0367482ebSalatStealer payload (confidence level: 95%)
debe06f29030037bde2986a205f41de8330b158a15cc7f8942e0cecdb3260a5aSalatStealer payload (confidence level: 95%)
b6dc91f04225fb3de7dc4daadc815ae8SalatStealer payload (confidence level: 95%)
4ba0de194b8a5c17182458ad3f70f34ed030983bSystemBC payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-02-15

Impact

For European organizations, the impact of this threat is currently limited due to the absence of known active exploits or targeted vulnerabilities. However, the presence of IOCs related to malware payload delivery and network activity suggests potential risks if adversaries leverage these indicators for intrusion attempts. Organizations relying on threat intelligence feeds can use this data to improve detection capabilities, potentially reducing the risk of successful compromise. The medium severity rating reflects moderate concern, implying that while immediate impact is low, failure to monitor or respond to these indicators could lead to undetected breaches or lateral movement within networks. Critical infrastructure and sectors with high exposure to network-based threats may face increased risk if these IOCs correlate with emerging attack campaigns. The lack of patches or specific affected versions reduces the urgency but underscores the importance of proactive monitoring and incident response readiness.

Defensive guidance

European organizations should integrate the provided IOCs into their existing security information and event management (SIEM) systems and endpoint detection and response (EDR) tools to enhance detection of related malware activity. Network traffic should be monitored for anomalies matching the described payload delivery and network activity patterns. Regular updates from threat intelligence feeds like ThreatFox should be automated to ensure timely incorporation of new indicators. Organizations should conduct threat hunting exercises focusing on these IOCs to identify any latent compromises. Additionally, reviewing and tightening network segmentation can limit potential lateral movement if an infection occurs. While no patches are available, maintaining up-to-date software and applying security best practices reduces overall attack surface. Employee awareness and phishing resistance training remain important to prevent initial payload delivery vectors. Finally, collaboration with national and European cybersecurity centers can improve situational awareness and coordinated response.

Community reviews

Loading reviews…