IndicatorPublished 11 Mar 2025Updated 12 Mar 2025

type osint · ThreatFox IOCs for 2025-03-11

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 382

check.gijuz.icuClearFake payload delivery domain (confidence level: 100%)
webmail.top5business.websiteHavoc botnet C2 domain (confidence level: 100%)
cpanel.homeimprovementbox.xyzHavoc botnet C2 domain (confidence level: 100%)
webdisk.fashionsforts.websiteHavoc botnet C2 domain (confidence level: 100%)
webdisk.mtstronggame7.xyzHavoc botnet C2 domain (confidence level: 100%)
cpcontacts.toptenufabetgames.xyzHavoc botnet C2 domain (confidence level: 100%)
cpcontacts.genralnewzupdates.xyzHavoc botnet C2 domain (confidence level: 100%)
ii.hastleup.inkHavoc botnet C2 domain (confidence level: 100%)
cpanel.dgmrtktnewz.websiteHavoc botnet C2 domain (confidence level: 100%)
check.kabuq.icuClearFake payload delivery domain (confidence level: 100%)

URLs 225

https://senelcicekcilik08.com/zjq2njg0mwjjnge0/Coper botnet C2 (confidence level: 80%)
https://kledgarentokat3535.com/zjq2njg0mwjjnge0/Coper botnet C2 (confidence level: 80%)
https://turhoslemar.com/zjq2njg0mwjjnge0/Coper botnet C2 (confidence level: 80%)
https://amasyaperdecilik.com/zjq2njg0mwjjnge0/Coper botnet C2 (confidence level: 80%)
https://ordneskrmvr5252.com/zjq2njg0mwjjnge0/Coper botnet C2 (confidence level: 80%)
https://aliatabakastakirkharamilers.com/mzuymgi3mtixowf/Coper botnet C2 (confidence level: 80%)
https://alibabacankirkharamiler.net/mzuymgi3mtixowfk/Coper botnet C2 (confidence level: 80%)
https://alibabacankirkharamiler.com/mzuymgi3mtixowfk/Coper botnet C2 (confidence level: 80%)
https://kirkharamilervealibabacans.net/mzuymgi3mtixowfk/Coper botnet C2 (confidence level: 80%)
https://kirkharamilersavastayinebea.com/mzuymgi3mtixowfk/Coper botnet C2 (confidence level: 80%)

IP addresses 226

185.42.12.21Tofsee botnet C2 server (confidence level: 100%)
185.42.12.21Tofsee botnet C2 server (confidence level: 100%)
185.42.12.21Tofsee botnet C2 server (confidence level: 100%)
185.42.12.21Tofsee botnet C2 server (confidence level: 100%)
172.93.165.173Remcos botnet C2 server (confidence level: 100%)
64.23.173.210Remcos botnet C2 server (confidence level: 100%)
45.59.104.62AsyncRAT botnet C2 server (confidence level: 100%)
45.59.104.62AsyncRAT botnet C2 server (confidence level: 100%)
103.249.135.212Hook botnet C2 server (confidence level: 100%)
196.130.183.240Quasar RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-03-11

Impact

For European organizations, the impact of this threat intelligence is primarily in the realm of improved situational awareness and threat detection rather than direct compromise. Since no specific vulnerabilities or exploits are identified, the immediate risk of system compromise or data breach is low. However, the presence of payload delivery and network activity indicators suggests that organizations should be vigilant for potential malware infections or network intrusions that could be related to these IOCs. If these indicators correspond to active campaigns, organizations could face risks such as unauthorized access, data exfiltration, or disruption of services. The medium severity rating implies that while the threat is not critical, it should not be ignored, especially in sectors with high exposure to targeted attacks. The lack of patches or exploits in the wild reduces urgency but does not eliminate the need for proactive monitoring and response capabilities.

Defensive guidance

1. Integrate the provided IOCs into existing security information and event management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enhance detection of related malicious activities. 2. Conduct regular network traffic analysis focusing on unusual payload delivery patterns and suspicious network activity that align with the threat categories. 3. Employ threat hunting exercises using the OSINT indicators to identify potential early-stage infections or reconnaissance activities within the network. 4. Maintain up-to-date endpoint protection and ensure that all systems follow best practices for security hygiene, including least privilege and network segmentation. 5. Train security personnel to recognize and respond to indicators associated with payload delivery and network-based threats, emphasizing the importance of correlating OSINT data with internal logs. 6. Collaborate with national and European cybersecurity information sharing organizations to receive timely updates and contextualize these IOCs within broader threat landscapes.

Community reviews

Loading reviews…