IndicatorPublished 18 Feb 2026Updated 19 Feb 2026

ThreatFox IOCs for 2026-02-18

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 194

datacloudhost4.babyUnknown Stealer botnet C2 domain (confidence level: 100%)
bracesarlington.comUnknown Stealer botnet C2 domain (confidence level: 100%)
urbanbike.velvetmaple.couponsClearFake payload delivery domain (confidence level: 100%)
serialmenot.comUnknown RAT botnet C2 domain (confidence level: 100%)
followahahaha.followz.stMirai botnet C2 domain (confidence level: 100%)
softgametime.comUnknown malware payload delivery domain (confidence level: 100%)
playdigitalzone.comUnknown malware payload delivery domain (confidence level: 100%)
kentexroofings.comUnknown malware payload delivery domain (confidence level: 100%)
hardform.stonecraft.couponsClearFake payload delivery domain (confidence level: 100%)
layerstone.stonecraft.couponsClearFake payload delivery domain (confidence level: 100%)

URLs 31

https://greecpt.shop/Unknown malware payload delivery URL (confidence level: 90%)
https://softgametime.com/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://playdigitalzone.com/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://kentexroofings.com/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
http://heradoux.com/4d54576e112f4297.phpStealc botnet C2 (confidence level: 100%)
http://62.182.81.38/Unknown malware botnet C2 (confidence level: 100%)
https://pastebin.com/raw/sdsdXWorm botnet C2 (confidence level: 50%)
https://tue.gadgetwalabd.com/Vidar botnet C2 (confidence level: 100%)
https://tue.alpinematters.com/Vidar botnet C2 (confidence level: 100%)
https://148.251.65.217/Vidar botnet C2 (confidence level: 100%)

IP addresses 133

172.86.114.147Mirai botnet C2 server (confidence level: 100%)
194.169.175.191zgRAT botnet C2 server (confidence level: 100%)
78.29.43.89XWorm botnet C2 server (confidence level: 100%)
23.234.88.233XenoRAT botnet C2 server (confidence level: 100%)
23.234.88.233XenoRAT botnet C2 server (confidence level: 100%)
156.205.97.11XWorm botnet C2 server (confidence level: 100%)
139.28.219.40Remcos botnet C2 server (confidence level: 100%)
193.26.115.167Remcos botnet C2 server (confidence level: 100%)
165.227.242.98Sliver botnet C2 server (confidence level: 100%)
128.90.115.176DCRat botnet C2 server (confidence level: 100%)

Hashes 6

784bc5b431fe71aaf85f7d39c014f099Interlock payload (confidence level: 100%)
9451420233168c7b0c595257d43c7b85Interlock payload (confidence level: 100%)
b2b03dfcdc2e59d81e99d20c15919a13Interlock payload (confidence level: 100%)
422755116ab311b473dd38ec88f129d9Interlock payload (confidence level: 100%)
c63e81ad806a0feeef913baf7b914c4fUnknown malware payload (confidence level: 100%)
f7d7377b17fc4cdcbb783cc090d6e983Unknown malware payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-02-18

Impact

The potential impact of this threat on European organizations is moderate due to its classification as medium severity and the lack of active exploitation or known vulnerabilities. The malware's focus on network activity and payload delivery suggests risks related to data exfiltration, unauthorized access, or disruption of services if successfully deployed. However, since no specific affected systems or software versions are identified, the scope of impact remains uncertain. European organizations with extensive network infrastructures and reliance on OSINT tools may face increased exposure if the malware leverages these vectors. The absence of patches or known exploits indicates that the threat is more intelligence-oriented, emphasizing detection over immediate remediation. Potential impacts include increased operational costs due to enhanced monitoring requirements and the risk of undetected malware presence leading to longer-term compromise. Organizations in sectors with high-value data or critical infrastructure may experience reputational damage or regulatory scrutiny if infections occur. Overall, the threat underscores the importance of continuous network monitoring and threat intelligence integration to mitigate potential risks.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection capabilities. 2. Conduct regular network traffic analysis focusing on unusual payload delivery patterns and OSINT-related activities to identify potential malware communications. 3. Employ threat hunting exercises using behavioral analytics to detect anomalies consistent with the described malware activity. 4. Maintain updated threat intelligence feeds and ensure cross-team communication to rapidly incorporate new indicators. 5. Implement network segmentation to limit lateral movement in case of infection. 6. Enhance endpoint detection and response (EDR) tools to monitor for suspicious payload execution or delivery mechanisms. 7. Train security teams on interpreting and acting upon OSINT-derived threat intelligence to improve proactive defense. 8. Review and tighten access controls around OSINT tools and data sources to reduce exposure. 9. Establish incident response playbooks tailored to malware delivery and network activity scenarios. 10. Collaborate with national and European cybersecurity centers to share intelligence and coordinate defensive measures.

Community reviews

Loading reviews…