IndicatorPublished 26 Feb 2026Updated 27 Feb 2026

ThreatFox IOCs for 2026-02-26

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 148

my.homesforsalegrovecityohio.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
cc.xbqpdj.vipMirai botnet C2 domain (confidence level: 100%)
ms-updater-service.orgUnknown malware botnet C2 domain (confidence level: 100%)
ms-updater-service.netUnknown malware botnet C2 domain (confidence level: 100%)
ms-updater-service.comUnknown malware botnet C2 domain (confidence level: 100%)
ms-cleaner.orgKongTuke botnet C2 domain (confidence level: 75%)
ms-cleaner.siteKongTuke botnet C2 domain (confidence level: 75%)
auth-ms-service.onlineKongTuke botnet C2 domain (confidence level: 75%)
auth-ms-service.comKongTuke botnet C2 domain (confidence level: 75%)
auth-ms-service.topKongTuke botnet C2 domain (confidence level: 75%)

URLs 18

https://socheaphost.com/ssa_gov/Unknown malware payload delivery URL (confidence level: 90%)
https://sidelinesports.com/Unknown malware payload delivery URL (confidence level: 90%)
http://89.169.12.235/api/nte3yjdjnwu1njyznju2yta1n2y=SmartLoader botnet C2 (confidence level: 75%)
http://213.176.73.159/api/nte3yjdjnwu1njyznju2yta1n2y=SmartLoader botnet C2 (confidence level: 75%)
http://213.176.73.151/api/nte3yjdjnwu1njyznju2yta1n2y=SmartLoader botnet C2 (confidence level: 75%)
http://oficialrem.duckdns.org:5000Unknown RAT botnet C2 (confidence level: 100%)
https://95.216.251.50/Vidar botnet C2 (confidence level: 100%)
https://46.224.192.164/Vidar botnet C2 (confidence level: 100%)
https://188.34.207.58/Vidar botnet C2 (confidence level: 100%)
https://46.225.57.98/Vidar botnet C2 (confidence level: 100%)

IP addresses 150

177.161.176.25Mirai botnet C2 server (confidence level: 100%)
193.187.151.199KongTuke botnet C2 server (confidence level: 75%)
45.12.2.167KongTuke botnet C2 server (confidence level: 75%)
37.27.0.76KongTuke botnet C2 server (confidence level: 75%)
91.235.116.139Mirai botnet C2 server (confidence level: 80%)
107.174.33.4Remcos botnet C2 server (confidence level: 100%)
43.212.196.212Unknown malware botnet C2 server (confidence level: 100%)
27.124.20.138Quasar RAT botnet C2 server (confidence level: 100%)
198.98.53.100MimiKatz botnet C2 server (confidence level: 100%)
148.113.54.163MimiKatz botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-02-26

Impact

The potential impact of this threat is moderate and largely depends on the ability of organizations to incorporate these IOCs into their security monitoring systems. Since no specific exploit or malware campaign is detailed, the immediate risk to confidentiality, integrity, or availability is limited. However, failure to monitor or respond to such intelligence could allow adversaries to conduct network reconnaissance, deliver payloads, or execute malware undetected, potentially leading to data breaches or system compromise. Organizations heavily reliant on OSINT and threat intelligence for proactive defense may experience improved detection capabilities by leveraging these IOCs. Conversely, entities lacking robust threat intelligence integration might miss early indicators of malicious activity. The absence of patches or known exploits suggests that this is not a zero-day or critical vulnerability but rather a component of ongoing threat actor activity that requires vigilance. Overall, the impact is situational and contingent on the organization's security posture and threat intelligence utilization.

Defensive guidance

1. Integrate ThreatFox IOCs into existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection of related network activity and payload delivery attempts. 2. Regularly update threat intelligence feeds and ensure automated ingestion of new IOCs to maintain up-to-date situational awareness. 3. Conduct network traffic analysis focusing on anomalies that match the behavioral patterns associated with the provided IOCs, even if specific indicators are not detailed. 4. Employ endpoint detection and response (EDR) tools to monitor for suspicious payload execution or malware behavior consistent with OSINT-derived threats. 5. Train security analysts to correlate OSINT data with internal logs to identify potential early signs of compromise. 6. Maintain robust incident response procedures to quickly investigate and contain any alerts triggered by these IOCs. 7. Since no patches are available, emphasize preventive controls such as network segmentation, least privilege access, and multi-factor authentication to reduce attack surface. 8. Collaborate with threat intelligence sharing communities to receive contextual updates and refine detection rules based on evolving threat actor tactics.

Community reviews

Loading reviews…