IndicatorPublished 24 Feb 2026Updated 25 Feb 2026

ThreatFox IOCs for 2026-02-24

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 196

geo-rock-sync-base.swiftcanyon.ruClearFake payload delivery domain (confidence level: 100%)
swift-flow-node.swiftcanyon.ruClearFake payload delivery domain (confidence level: 100%)
silvernode.digitalClearFake payload delivery domain (confidence level: 100%)
media-publisher.ruStrelaStealer payload delivery domain (confidence level: 100%)
clear-field-view.clearfield.in.netClearFake payload delivery domain (confidence level: 100%)
devel.reputationreviews.orgFAKEUPDATES botnet C2 domain (confidence level: 100%)
open-zone-monitor.clearfield.in.netClearFake payload delivery domain (confidence level: 100%)
mediacityinc.comStrelaStealer payload delivery domain (confidence level: 100%)
field-logic-base.clearfield.in.netClearFake payload delivery domain (confidence level: 100%)
data-clear-sync.clearfield.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 71

http://154.94.237.240:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://dblanka.com/Unknown malware payload delivery URL (confidence level: 90%)
http://185.182.187.151/api/agent/registerUnknown RAT botnet C2 (confidence level: 100%)
http://185.182.187.151/ws/agentUnknown RAT botnet C2 (confidence level: 100%)
https://74.0.32.70/Vidar botnet C2 (confidence level: 100%)
https://138.226.237.176/Vidar botnet C2 (confidence level: 100%)
https://74.0.48.29/Vidar botnet C2 (confidence level: 100%)
https://46.225.101.68/Vidar botnet C2 (confidence level: 100%)
https://74.0.32.8/Vidar botnet C2 (confidence level: 100%)
https://95.216.251.49/Vidar botnet C2 (confidence level: 100%)

IP addresses 129

27.102.137.81Mirai botnet C2 server (confidence level: 100%)
43.226.125.76Ghost RAT botnet C2 server (confidence level: 100%)
186.169.63.236Remcos botnet C2 server (confidence level: 100%)
159.69.10.36Unknown malware botnet C2 server (confidence level: 100%)
45.64.52.146Ghost RAT botnet C2 server (confidence level: 75%)
43.226.125.90Ghost RAT botnet C2 server (confidence level: 75%)
45.38.42.189Unknown malware botnet C2 server (confidence level: 100%)
46.246.6.3DCRat botnet C2 server (confidence level: 100%)
212.71.250.244Xtreme RAT botnet C2 server (confidence level: 100%)
102.159.97.234QakBot botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-02-24

Impact

The impact of this threat intelligence update is primarily on the detection and monitoring capabilities of organizations rather than direct exploitation or compromise. Since no specific vulnerabilities or exploits are detailed, the immediate risk of system compromise is low. However, failure to incorporate these IOCs into security monitoring tools could result in missed detection of malware activity or payload delivery attempts associated with the indicators. Organizations worldwide that rely on threat intelligence feeds for proactive defense will benefit from enhanced situational awareness. The lack of known exploits in the wild reduces the urgency but does not eliminate the potential for future exploitation if adversaries leverage these indicators. Overall, the impact is medium in terms of improving defensive posture but low in terms of immediate threat to confidentiality, integrity, or availability.

Defensive guidance

Organizations should integrate the provided IOCs into their existing security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection capabilities. Regularly updating threat intelligence feeds and correlating these IOCs with internal logs can help identify potential malicious activity early. Network segmentation and strict egress filtering can limit the impact of payload delivery attempts. Security teams should also conduct threat hunting exercises using these indicators to proactively identify any signs of compromise. Since no patches or specific vulnerability mitigations are available, emphasis should be placed on detection, monitoring, and incident response preparedness. Sharing findings and feedback with the broader security community can improve collective defense. Finally, maintaining updated asset inventories and ensuring robust backup and recovery processes will help mitigate potential impacts of any future exploitation related to these indicators.

Community reviews

Loading reviews…