IndicatorPublished 27 Feb 2026Updated 28 Feb 2026

ThreatFox IOCs for 2026-02-27

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 146

wuliaox.comKongTuke payload delivery domain (confidence level: 100%)
eshleytrei.topSmartApeSG payload delivery domain (confidence level: 100%)
teshlsy.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
maisonboncenne.comStrelaStealer payload delivery domain (confidence level: 100%)
maisonmono.infoStrelaStealer payload delivery domain (confidence level: 100%)
maistel.com.brStrelaStealer payload delivery domain (confidence level: 100%)
maisveiculoserechim.com.brStrelaStealer payload delivery domain (confidence level: 100%)
majabie.comStrelaStealer payload delivery domain (confidence level: 100%)
majesticbuildingmaintenance.caStrelaStealer payload delivery domain (confidence level: 100%)
majorel.eeStrelaStealer payload delivery domain (confidence level: 100%)

URLs 26

https://wuliaox.com/2g5a.jsKongTuke payload delivery URL (confidence level: 100%)
https://wuliaox.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
https://eshleytrei.top/api/api-theme.phpSmartApeSG payload delivery URL (confidence level: 100%)
https://eshleytrei.top/api/private-compiler.jsSmartApeSG payload delivery URL (confidence level: 100%)
https://freuterby.com/angleSmartApeSG payload delivery URL (confidence level: 100%)
https://89.46.38.121/conciseSmartApeSG payload delivery URL (confidence level: 100%)
https://verify-slack.com/Unknown malware payload delivery URL (confidence level: 90%)
https://goansgsr.shop/Unknown malware payload delivery URL (confidence level: 90%)
https://inheritance-claims-portal-32792.com/Unknown malware payload delivery URL (confidence level: 90%)
http://ck929350.tw1.ru/aad8356b.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 127

68.183.45.80Aisuru botnet C2 server (confidence level: 100%)
46.101.85.248Aisuru botnet C2 server (confidence level: 100%)
206.189.177.137Aisuru botnet C2 server (confidence level: 100%)
68.183.45.80Aisuru botnet C2 server (confidence level: 100%)
46.101.85.248Aisuru botnet C2 server (confidence level: 100%)
212.104.141.101Bashlite botnet C2 server (confidence level: 100%)
206.189.177.137Aisuru botnet C2 server (confidence level: 100%)
46.101.85.248Aisuru botnet C2 server (confidence level: 100%)
206.189.177.137Aisuru botnet C2 server (confidence level: 100%)
46.101.85.248Aisuru botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-02-27

Impact

Given the lack of specific affected products, no known active exploits, and no patches available, the immediate impact on organizations worldwide is limited. The threat represents potential malware activity that could be used for payload delivery or network intrusion if leveraged by attackers, but no direct evidence of exploitation is present. Organizations relying on threat intelligence feeds like ThreatFox can use this information to enhance detection capabilities and prepare for possible future threats. However, the absence of concrete attack details or vulnerabilities means that the current risk to confidentiality, integrity, and availability is low to medium. The main impact is informational, supporting proactive defense rather than reactive incident response.

Defensive guidance

Organizations should integrate ThreatFox IOCs into their security monitoring and threat intelligence platforms to improve detection of related malware activity. Regularly updating intrusion detection and prevention systems with the latest IOCs can help identify potential payload delivery attempts or suspicious network activity. Since no patches are available, focus should be on network segmentation, strict access controls, and anomaly detection to mitigate potential exploitation. Security teams should also maintain vigilance for any updates or changes in threat intelligence that might indicate emerging exploits. Conducting regular threat hunting exercises using these IOCs can help identify early signs of compromise. Additionally, educating staff on recognizing phishing or social engineering attempts that could deliver payloads remains critical.

Community reviews

Loading reviews…