IndicatorPublished 16 Feb 2026Updated 17 Feb 2026

ThreatFox IOCs for 2026-02-16

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 216

fonts-fontawesome.cfdUnknown malware payload delivery domain (confidence level: 100%)
winupdateconf.cfdUnknown malware payload delivery domain (confidence level: 100%)
winupdate.cfdUnknown malware payload delivery domain (confidence level: 100%)
cdn-clodflare-fotns.cfdUnknown malware payload delivery domain (confidence level: 100%)
alffsave.clickUnknown malware payload delivery domain (confidence level: 100%)
cdn-clodflare-fotns.clickUnknown malware payload delivery domain (confidence level: 100%)
sccdnd-ltyles.clickUnknown malware payload delivery domain (confidence level: 100%)
bssapi.clickUnknown malware payload delivery domain (confidence level: 100%)
sdn-cloudflare-js-botstrup.clickUnknown malware payload delivery domain (confidence level: 100%)
cdn2-server.clickUnknown malware payload delivery domain (confidence level: 100%)

URLs 60

http://94.154.35.115/user_profiles_photo/cptchbuild.binUnknown malware payload delivery URL (confidence level: 100%)
http://94.154.35.115/user_profiles_photo/chromelevator.binUnknown malware payload delivery URL (confidence level: 100%)
http://158.94.209.33Unknown malware payload delivery URL (confidence level: 100%)
https://cdn-server.click/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://fonts-fontawesome.cfdUnknown malware payload delivery URL (confidence level: 100%)
https://winupdateconf.cfdUnknown malware payload delivery URL (confidence level: 100%)
https://winupdate.cfdUnknown malware payload delivery URL (confidence level: 100%)
https://sdn-cloudflare-js.cfd/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://cdn-clodflare-fotns.cfd/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://alffsave.clickUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 157

198.244.201.139Remcos botnet C2 server (confidence level: 100%)
195.211.96.77Remcos botnet C2 server (confidence level: 100%)
45.243.236.40XWorm botnet C2 server (confidence level: 100%)
80.71.224.47Mirai botnet C2 server (confidence level: 100%)
185.243.241.94Ghost RAT botnet C2 server (confidence level: 100%)
144.124.242.84SectopRAT botnet C2 server (confidence level: 100%)
102.117.166.65Unknown malware botnet C2 server (confidence level: 100%)
3.139.237.36Meterpreter botnet C2 server (confidence level: 100%)
192.159.99.107Quasar RAT botnet C2 server (confidence level: 100%)
37.221.66.75Mirai botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-02-16

Impact

The direct impact of this ThreatFox IOC feed on European organizations is limited due to the lack of specific exploit details or active threats. However, the availability of updated IOCs can enhance the detection and mitigation of malware campaigns that use network-based payload delivery. Organizations leveraging this intelligence can improve their security posture by identifying suspicious network activity early, reducing the risk of successful infections or data breaches. The medium severity suggests a moderate risk that, if unmonitored, could lead to undetected malware infiltration. For European entities, especially those in critical infrastructure, finance, and government sectors, timely integration of such OSINT feeds into security operations centers (SOCs) can prevent lateral movement and data exfiltration attempts. The absence of patches or known exploits means the threat is not currently active or widespread but could evolve. Therefore, the impact is more preventive and intelligence-driven rather than reactive to an ongoing attack.

Defensive guidance

1. Integrate ThreatFox and similar OSINT feeds into existing Security Information and Event Management (SIEM) and threat detection platforms to enable real-time alerting on relevant IOCs. 2. Regularly update network intrusion detection and prevention systems (IDS/IPS) with the latest IOCs from trusted sources to detect payload delivery attempts. 3. Conduct proactive threat hunting exercises using the provided IOCs to identify any early signs of compromise within the network. 4. Enhance employee awareness and training on recognizing phishing and social engineering tactics that may be used to deliver payloads associated with these IOCs. 5. Implement network segmentation and strict egress filtering to limit the impact of any successful malware delivery. 6. Collaborate with national and European cybersecurity information sharing organizations to contextualize and validate the relevance of these IOCs. 7. Maintain up-to-date endpoint protection solutions capable of detecting and blocking malware payloads indicated by the threat intelligence. These measures go beyond generic advice by emphasizing integration of OSINT feeds, proactive hunting, and collaboration tailored to the nature of the threat intelligence.

Community reviews

Loading reviews…