Skip to main content
IndicatorPublished Updated

ThreatFox IOCs for 2026-02-20

Source ThreatFox MISP Feed

0

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 134

  • ainttby.comKongTuke payload delivery domain (confidence level: 100%)
  • excessmon001.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
  • x1edaroughgan8hajous20.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
  • x1edaroughgan8hajous30.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
  • x1edaroughgan8hajous40.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
  • cygnusn.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
  • khantym.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
  • salivae.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
  • swederq.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
  • transpd.cyouLumma Stealer botnet C2 domain (confidence level: 75%)

URLs 8

  • https://ainttby.com/6f54.jsKongTuke payload delivery URL (confidence level: 100%)
  • https://ainttby.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
  • http://212.85.166.12:22448/.iUnknown malware payload delivery URL (confidence level: 75%)
  • https://89.58.25.125/Unknown malware payload delivery URL (confidence level: 90%)
  • http://198.46.147.169:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
  • http://abscete.info/zetus/five/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
  • http://bobrecurwarmumsworms.com:8080/updater?for=1366407c325e73b05f171b2364a70d1bUnknown malware botnet C2 (confidence level: 100%)
  • http://waterpressureelement.cc:8080/updater?for=0aa6b9f07a5b27b2069c137c69ec91ebUnknown malware botnet C2 (confidence level: 100%)

IP addresses 81

  • 193.26.115.60Remcos botnet C2 server (confidence level: 100%)
  • 38.49.215.118PureRAT botnet C2 server (confidence level: 100%)
  • 23.94.252.101XWorm botnet C2 server (confidence level: 100%)
  • 83.142.209.92PureRAT botnet C2 server (confidence level: 100%)
  • 203.192.206.72AsyncRAT botnet C2 server (confidence level: 100%)
  • 193.124.250.110XWorm botnet C2 server (confidence level: 100%)
  • 172.94.111.65Remcos botnet C2 server (confidence level: 100%)
  • 5.101.86.26Remcos botnet C2 server (confidence level: 100%)
  • 89.40.206.98Remcos botnet C2 server (confidence level: 100%)
  • 91.92.243.47Venom RAT botnet C2 server (confidence level: 100%)

Description

This entry provides Indicators of Compromise (IOCs) related to ThreatFox for the date 2026-02-20. It is categorized under OSINT, network activity, and payload delivery, indicating it relates to observed malicious activity or malware delivery mechanisms. No specific technical details, affected software versions, or exploit information are provided.

Community reviews

Loading reviews…