IndicatorPublished 22 Feb 2026Updated 23 Feb 2026

ThreatFox IOCs for 2026-02-22

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 194

tightfeather.condenfeather.ruClearFake payload delivery domain (confidence level: 100%)
clearscript.purecode.in.netClearFake payload delivery domain (confidence level: 100%)
dutycourier.servantakeaway.ruClearFake payload delivery domain (confidence level: 100%)
mildnode.mildtech.in.netClearFake payload delivery domain (confidence level: 100%)
brightflash.neondata.in.netClearFake payload delivery domain (confidence level: 100%)
glowbase.neondata.in.netClearFake payload delivery domain (confidence level: 100%)
citypulse.neondata.in.netClearFake payload delivery domain (confidence level: 100%)
neonlink.neondata.in.netClearFake payload delivery domain (confidence level: 100%)
dcenevinew.duckdns.orgAsyncRAT botnet C2 domain (confidence level: 100%)
xoeyxsife-33031.portmap.hostXWorm botnet C2 domain (confidence level: 100%)

URLs 20

https://mac-os-helper.com/Unknown malware payload delivery URL (confidence level: 90%)
https://aiselfie.cam/Unknown malware payload delivery URL (confidence level: 90%)
http://eyota.com.sg/group/panelnew/gate.phpPony botnet C2 (confidence level: 100%)
https://store-image.shop/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://vaer-cdn-3.sbs/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://image-hoster11.sbs/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://nstv-css-styles-19.sbs/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://dltucra.com/data.phpUnknown malware payload delivery URL (confidence level: 100%)
https://dltucra.com/data.zipUnknown malware payload delivery URL (confidence level: 100%)
https://dltucra.com/test.phpUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 79

206.123.145.26Mirai botnet C2 server (confidence level: 80%)
168.245.203.177Meterpreter botnet C2 server (confidence level: 100%)
16.63.109.40Meterpreter botnet C2 server (confidence level: 100%)
13.221.157.7Meterpreter botnet C2 server (confidence level: 100%)
108.130.208.104Meterpreter botnet C2 server (confidence level: 100%)
8.131.77.227Cobalt Strike botnet C2 server (confidence level: 100%)
94.242.52.79Unknown malware botnet C2 server (confidence level: 100%)
46.246.86.9DCRat botnet C2 server (confidence level: 100%)
79.107.150.203QakBot botnet C2 server (confidence level: 100%)
193.161.193.99XWorm botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-02-22

Impact

Given the lack of specific exploit details or active attacks, the immediate impact on organizations worldwide is limited. However, the presence of new IOCs related to malware payload delivery and network activity indicates potential reconnaissance or preparatory stages of cyber threats. Organizations that do not incorporate updated threat intelligence feeds may miss early signs of emerging threats, potentially leading to delayed detection and response. The medium severity suggests that while the threat is not critical, it could contribute to successful attacks if combined with other vulnerabilities or social engineering tactics. The impact is primarily on security monitoring and incident response effectiveness rather than direct system compromise at this stage.

Defensive guidance

Organizations should integrate ThreatFox and similar OSINT feeds into their Security Information and Event Management (SIEM) and threat detection platforms to leverage the provided IOCs for enhanced monitoring. Regularly updating detection rules and signatures based on these feeds can improve early warning capabilities. Conduct proactive network traffic analysis focusing on payload delivery patterns and suspicious network activity aligned with the IOCs. Employ threat hunting exercises to identify any signs of compromise related to the indicators. Maintain robust incident response plans to quickly address any alerts triggered by these IOCs. Since no patches are available, focus on detection and containment strategies rather than remediation. Collaboration with threat intelligence communities can provide additional context and updates.

Community reviews

Loading reviews…