IndicatorPublished 19 Feb 2026Updated 20 Feb 2026

ThreatFox IOCs for 2026-02-19

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 182

systemcore.murta46unprin.couponsClearFake payload delivery domain (confidence level: 100%)
hodorit.comSmartApeSG payload delivery domain (confidence level: 100%)
3mi05cn7h7k4ecsb.frostapi.comUnknown Stealer botnet C2 domain (confidence level: 100%)
botnet.exiled.fitMirai botnet C2 domain (confidence level: 100%)
mieyabi.comKongTuke payload delivery domain (confidence level: 100%)
stonepath.rockwood.couponsClearFake payload delivery domain (confidence level: 100%)
solidleaf.rockwood.couponsClearFake payload delivery domain (confidence level: 100%)
fruitcase.plum63box.couponsClearFake payload delivery domain (confidence level: 100%)
redplum.plum63box.couponsClearFake payload delivery domain (confidence level: 100%)
boxstore.plum63box.couponsClearFake payload delivery domain (confidence level: 100%)

URLs 19

https://www.gorscts.shop/Unknown malware payload delivery URL (confidence level: 90%)
https://hodorit.com/identity/route-sandbox.phpSmartApeSG payload delivery URL (confidence level: 100%)
https://hodorit.com/identity/rate-util.jsSmartApeSG payload delivery URL (confidence level: 100%)
https://cirealci.com/froute1SmartApeSG payload delivery URL (confidence level: 100%)
https://185.33.87.29/zipp2SmartApeSG payload delivery URL (confidence level: 100%)
https://74.0.48.206/Vidar botnet C2 (confidence level: 100%)
https://mieyabi.com/5j1s.jsKongTuke payload delivery URL (confidence level: 100%)
https://mieyabi.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
http://91.92.243.29/klobPhorpiex payload delivery URL (confidence level: 100%)
https://polygon.qbetfhwz.xyz/gate/healthUnknown Stealer botnet C2 (confidence level: 100%)

IP addresses 136

8.162.5.187XWorm botnet C2 server (confidence level: 100%)
193.161.193.99NjRAT botnet C2 server (confidence level: 100%)
45.150.32.124Stealc botnet C2 server (confidence level: 100%)
45.94.31.178DoublePulsar botnet C2 server (confidence level: 100%)
206.123.132.224Quasar RAT botnet C2 server (confidence level: 100%)
198.244.201.139XWorm botnet C2 server (confidence level: 100%)
172.105.85.143XWorm botnet C2 server (confidence level: 100%)
89.167.52.86Mirai botnet C2 server (confidence level: 100%)
146.70.181.238Remcos botnet C2 server (confidence level: 100%)
172.111.162.252Remcos botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-02-19

Impact

Given the limited information and absence of known exploits or patches, the immediate impact on organizations is likely low to medium. However, the presence of payload delivery and network activity tags indicates potential risks of malware infections if related IOCs are encountered in operational environments. Organizations relying heavily on OSINT tools or integrating ThreatFox feeds into their security operations may be better positioned to detect and respond to such threats. The lack of specific affected versions or vulnerabilities suggests this is not a targeted exploit but rather a general malware campaign or intelligence artifact. If payload delivery attempts succeed, impacts could include data compromise, system disruption, or lateral movement within networks. The medium severity rating suggests a moderate risk that warrants attention but does not indicate an imminent critical threat. Overall, the impact is contingent on the ability of organizations to detect and mitigate suspicious network activity and payloads associated with these IOCs.

Defensive guidance

1. Integrate ThreatFox and other OSINT feeds into Security Information and Event Management (SIEM) systems to enable real-time detection of related IOCs. 2. Enhance network monitoring to identify unusual payload delivery attempts or suspicious network activity patterns. 3. Employ endpoint detection and response (EDR) tools to detect and block malware payloads early in the infection chain. 4. Conduct regular threat hunting exercises focusing on network traffic anomalies and payload signatures associated with the shared IOCs. 5. Maintain updated and comprehensive incident response plans that include procedures for handling malware infections and network intrusions. 6. Educate security teams on interpreting OSINT threat intelligence and correlating it with internal telemetry for proactive defense. 7. Since no patches are available, focus on hardening network segmentation and access controls to limit potential malware spread. 8. Validate and tune intrusion detection/prevention systems (IDS/IPS) to recognize patterns consistent with the described threat activity. These steps go beyond generic advice by emphasizing the operational integration of OSINT feeds and proactive network and endpoint monitoring tailored to the threat characteristics.

Community reviews

Loading reviews…