IndicatorPublished 21 Feb 2026Updated 22 Feb 2026

ThreatFox IOCs for 2026-02-21

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 309

tapnetic.proUnknown malware botnet C2 domain (confidence level: 100%)
shorepoint.lakeford.in.netClearFake payload delivery domain (confidence level: 100%)
deepref.silverbay.in.netClearFake payload delivery domain (confidence level: 100%)
mythic.dadUnknown Stealer botnet C2 domain (confidence level: 100%)
bkns-partns.comHavoc botnet C2 domain (confidence level: 100%)
bkns-connecs.comHavoc botnet C2 domain (confidence level: 100%)
jcy98d7wk.localto.netXWorm botnet C2 domain (confidence level: 100%)
fahadx700-53150.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
porfs.servehalflife.comXWorm botnet C2 domain (confidence level: 100%)
vlxx88.meAsyncRAT botnet C2 domain (confidence level: 100%)

URLs 215

https://goarnsds.shop/Unknown malware payload delivery URL (confidence level: 90%)
http://143.92.60.24:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://45.95.146.23/mao_http.shUnknown malware payload delivery URL (confidence level: 75%)
https://85.28.47.30/920475a59bac849d.phpStealc botnet C2 (confidence level: 50%)
http://193.38.248.139/8c91e91fdd93452c.phpStealc botnet C2 (confidence level: 50%)
https://89.23.103.42/hb9ivshs02/index.phpAmadey botnet C2 (confidence level: 50%)
https://alwinshop.xyz/SpyNote botnet C2 (confidence level: 50%)
http://betsan01.top/download.php?file=lv.exeCryptBot payload delivery URL (confidence level: 50%)
http://devtu35.top/index.phpCryptBot botnet C2 (confidence level: 50%)
http://morfec03.top/index.phpCryptBot botnet C2 (confidence level: 50%)

IP addresses 101

180.93.52.81Mirai botnet C2 server (confidence level: 100%)
159.65.99.110Aisuru botnet C2 server (confidence level: 100%)
68.183.40.248Aisuru botnet C2 server (confidence level: 100%)
192.109.139.158Remcos botnet C2 server (confidence level: 100%)
194.135.20.24Havoc botnet C2 server (confidence level: 100%)
102.98.90.86NetSupportManager RAT botnet C2 server (confidence level: 100%)
165.245.186.179Unknown malware botnet C2 server (confidence level: 100%)
3.29.67.62Meterpreter botnet C2 server (confidence level: 100%)
3.29.67.62Meterpreter botnet C2 server (confidence level: 100%)
43.210.37.47Meterpreter botnet C2 server (confidence level: 100%)

Hashes 177

5d44415310ab34ce684ac4b5c9b745c6323c71d1Stealc payload (confidence level: 95%)
3c5c9dd2805f966c117f63964798fdc25008f056e313c08397839ca3305b903bStealc payload (confidence level: 95%)
436034112d7bfae4ec5e68d1bc682722Stealc payload (confidence level: 95%)
535d737481f30895c874271c3584156fb6e9431aAsyncRAT payload (confidence level: 95%)
794790e9f8d17da9a50e9387b76c0d78d8a7d2af33ea75e9159089917ab697c2AsyncRAT payload (confidence level: 95%)
51ce62f62ba5e2f424e8954893e6d815AsyncRAT payload (confidence level: 95%)
9076e30a647a961f7578ff2cda20fbb8f119bd28XWorm payload (confidence level: 95%)
519a114231809dca8849f6f9e3653ffcbdd8244845023668a3e3a90be8aa6662XWorm payload (confidence level: 95%)
0085165a47472cefc4e3d4385f656382XWorm payload (confidence level: 95%)
a53e4a88a51c4defd1b33bd94c5cdd939f779617Coinminer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-02-21

Impact

The potential impact of this threat is currently limited due to the absence of known exploits and specific affected systems. Organizations worldwide may experience increased network reconnaissance or payload delivery attempts associated with the malware described, but no direct compromise or widespread attacks are reported. The medium severity rating indicates a moderate risk that could escalate if further details or exploits emerge. The threat primarily affects entities relying on OSINT tools and network monitoring, possibly leading to increased alert volumes and the need for enhanced analysis capabilities. Without patches or direct exploit information, the impact is more on operational security and threat awareness rather than immediate confidentiality, integrity, or availability breaches. Organizations should consider this an intelligence update to inform their threat hunting and incident response processes rather than an urgent security incident.

Defensive guidance

Given the nature of this intelligence feed update, specific mitigation steps include: 1) Integrate ThreatFox IOCs into existing Security Information and Event Management (SIEM) and threat intelligence platforms to enhance detection capabilities. 2) Conduct proactive network monitoring for unusual payload delivery patterns or suspicious OSINT-related network activity. 3) Maintain updated endpoint detection and response (EDR) solutions to identify potential malware behavior early. 4) Train security analysts to recognize and correlate emerging threat intelligence from OSINT feeds to improve situational awareness. 5) Establish incident response playbooks that incorporate threat intelligence ingestion and validation processes. 6) Collaborate with information sharing communities to stay informed about any escalation or exploitation related to these IOCs. 7) Regularly review and update firewall and intrusion detection system (IDS) rules based on new intelligence. These steps go beyond generic advice by emphasizing integration and operationalization of threat intelligence rather than generic patching or user awareness alone.

Community reviews

Loading reviews…