IndicatorPublished 23 Feb 2026Updated 24 Feb 2026

ThreatFox IOCs for 2026-02-23

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 846

chronosyncmanager.swallowtime.in.netClearFake payload delivery domain (confidence level: 100%)
temporallogicunit.swallowtime.in.netClearFake payload delivery domain (confidence level: 100%)
historyflowsystem.swallowtime.in.netClearFake payload delivery domain (confidence level: 100%)
intervalchecknode.swallowtime.in.netClearFake payload delivery domain (confidence level: 100%)
geological-survey-point.vividrock.ruClearFake payload delivery domain (confidence level: 100%)
core-stone-vault.vividrock.ruClearFake payload delivery domain (confidence level: 100%)
fkeasfodsfkefoapdsofkp-33083.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
main-monitoring-station.vividrock.ruClearFake payload delivery domain (confidence level: 100%)
2lrej7f0.microzen.digitalClearFake payload delivery domain (confidence level: 100%)
lg1kpu12.microzen.digitalClearFake payload delivery domain (confidence level: 100%)

URLs 98

https://12aedehyj4dg79vd6w00fck854y3vun4cqgj.t3.storage.dev/verify-to-continue-id-ktpos-260216.htmlUnknown malware payload delivery URL (confidence level: 90%)
http://basilicros.su/asdasqLumma Stealer botnet C2 (confidence level: 75%)
http://bowlina.cyouLumma Stealer botnet C2 (confidence level: 75%)
http://broguenko.su/asfaseLumma Stealer botnet C2 (confidence level: 75%)
http://familyriwo.su/fssdawLumma Stealer botnet C2 (confidence level: 75%)
http://hammernew.su/asdaseLumma Stealer botnet C2 (confidence level: 75%)
http://heavylussy.su/ccvfdLumma Stealer botnet C2 (confidence level: 75%)
http://homuncloud.su/ascasefLumma Stealer botnet C2 (confidence level: 75%)
http://izzardtow.su/cascascLumma Stealer botnet C2 (confidence level: 75%)
http://whitepepper.su/asdsLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 167

94.156.152.23Mirai botnet C2 server (confidence level: 100%)
149.28.242.44AdaptixC2 botnet C2 server (confidence level: 100%)
16.78.46.212Meterpreter botnet C2 server (confidence level: 100%)
16.78.46.212Meterpreter botnet C2 server (confidence level: 100%)
45.64.52.196Ghost RAT botnet C2 server (confidence level: 75%)
118.107.44.179Ghost RAT botnet C2 server (confidence level: 75%)
91.92.243.97Venom RAT botnet C2 server (confidence level: 100%)
81.19.137.207Unknown malware botnet C2 server (confidence level: 100%)
47.236.41.46Xtreme RAT botnet C2 server (confidence level: 100%)
118.107.44.175Ghost RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-02-23

Impact

The potential impact of this threat lies primarily in its role as an early warning or detection mechanism for malware-related network activity and payload delivery attempts. Organizations worldwide could face risks if these IOCs correspond to emerging or ongoing campaigns that attempt to infiltrate networks or deliver malicious payloads. Successful exploitation could lead to data breaches, system compromise, or disruption of services. However, since no active exploits or specific vulnerabilities are identified, the immediate impact is limited. The threat intelligence can help organizations detect and respond to suspicious network behaviors before they escalate into full-scale attacks. Failure to incorporate such intelligence could result in delayed detection of malware infections or network intrusions, increasing the risk of damage. The medium severity suggests a moderate level of concern, emphasizing the importance of proactive monitoring and incident response readiness.

Defensive guidance

To mitigate risks associated with this threat intelligence, organizations should: 1) Integrate the ThreatFox IOCs into their Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection capabilities. 2) Regularly update threat intelligence feeds to ensure timely awareness of emerging indicators related to malware and payload delivery. 3) Conduct network traffic analysis focusing on anomalies or patterns matching the provided IOCs to identify potential malicious activity early. 4) Implement strict network segmentation and access controls to limit the spread of malware if payload delivery attempts succeed. 5) Train security teams to interpret and act upon OSINT-derived threat intelligence effectively. 6) Maintain robust incident response plans that incorporate threat intelligence for rapid containment and remediation. 7) Since no patches are available, emphasize preventive controls such as endpoint protection, network monitoring, and user awareness to reduce attack surface. These steps go beyond generic advice by focusing on operationalizing the specific threat intelligence feed and enhancing detection and response workflows.

Community reviews

Loading reviews…