IndicatorPublished 28 Feb 2026Updated 1 Mar 2026

ThreatFox IOCs for 2026-02-28

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 204

matovicaccounting.com.auStrelaStealer payload delivery domain (confidence level: 100%)
matteotostoni.deStrelaStealer payload delivery domain (confidence level: 100%)
45.135.194.23.ptr.pfcloud.networkMirai botnet C2 domain (confidence level: 80%)
matthewspj.caStrelaStealer payload delivery domain (confidence level: 100%)
matthiaserath.deStrelaStealer payload delivery domain (confidence level: 100%)
mattsmachineshop.co.ukStrelaStealer payload delivery domain (confidence level: 100%)
mawani.netStrelaStealer payload delivery domain (confidence level: 100%)
akiyonoguchi.comAsyncRAT botnet C2 domain (confidence level: 75%)
artiminds.comAsyncRAT botnet C2 domain (confidence level: 75%)
atex.akiyonoguchi.comAsyncRAT botnet C2 domain (confidence level: 75%)

URLs 16

http://89.169.12.245/api/nte3yjdjnwu1njyznju2yta1n2y=SmartLoader botnet C2 (confidence level: 75%)
http://213.176.73.160/api/nte3yjdjnwu1njyznju2yta1n2y=SmartLoader botnet C2 (confidence level: 75%)
https://store-image.sbs/api/css.jsUnknown malware payload delivery URL (confidence level: 100%)
https://yutoridesignpty.com/test.phpUnknown malware payload delivery URL (confidence level: 100%)
https://yutoridesignpty.com/configpack.zipUnknown malware payload delivery URL (confidence level: 100%)
https://yutoridesignpty.com/helpu.phpUnknown malware payload delivery URL (confidence level: 100%)
https://yutoridesignpty.com/server.phpUnknown malware payload delivery URL (confidence level: 100%)
https://yutoridesignpty.com/data.phpUnknown malware payload delivery URL (confidence level: 100%)
https://yutoridesignpty.com/data.zipUnknown malware payload delivery URL (confidence level: 100%)
http://192.109.200.63/reloadAmatera botnet C2 (confidence level: 100%)

IP addresses 128

94.156.152.67Mirai botnet C2 server (confidence level: 100%)
23.248.213.115Cobalt Strike botnet C2 server (confidence level: 100%)
130.94.33.141GobRAT botnet C2 server (confidence level: 100%)
65.108.225.254Sliver botnet C2 server (confidence level: 100%)
199.101.111.143Meterpreter botnet C2 server (confidence level: 100%)
78.29.43.89NjRAT botnet C2 server (confidence level: 100%)
45.135.194.23Mirai botnet C2 server (confidence level: 80%)
59.110.40.60Cobalt Strike botnet C2 server (confidence level: 75%)
156.224.28.186Cobalt Strike botnet C2 server (confidence level: 100%)
178.255.244.5Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-02-28

Impact

Given the lack of detailed technical information and absence of known exploits in the wild, the immediate impact of this threat on organizations is likely limited. However, the categorization under payload delivery and network activity suggests potential risks of malware infection through network vectors if the threat evolves or is exploited in the future. Organizations worldwide could face risks such as unauthorized access, data exfiltration, or service disruption if this malware becomes active and widespread. The medium severity rating implies moderate potential for confidentiality, integrity, or availability impact, but the current lack of exploitation reduces urgency. Without specific IOCs or affected products, targeted defense is challenging, increasing the risk of undetected infections if organizations do not maintain robust network monitoring and threat intelligence capabilities. The impact is therefore more preventive and preparatory rather than reactive at this stage.

Defensive guidance

1. Integrate ThreatFox MISP feed and other OSINT sources into existing Security Information and Event Management (SIEM) and Intrusion Detection Systems (IDS) to enhance detection of emerging malware-related network activity. 2. Conduct regular network traffic analysis focusing on unusual payload delivery patterns or anomalies that could indicate malware communication or infection attempts. 3. Maintain up-to-date endpoint protection and network segmentation to limit potential malware spread even in the absence of specific patches. 4. Implement strict access controls and monitor for unusual authentication or lateral movement behaviors that could signal compromise. 5. Train security teams to recognize and respond to generic malware indicators and to escalate suspicious findings for deeper forensic analysis. 6. Establish incident response playbooks that include procedures for handling unknown or emerging malware threats with limited initial information. 7. Collaborate with threat intelligence communities to share findings and receive updates on any evolution of this threat. These steps go beyond generic advice by emphasizing proactive intelligence integration, network behavior analysis, and preparedness for low-information threat scenarios.

Community reviews

Loading reviews…