IndicatorPublished 16 Jun 2025Updated 17 Jun 2025

type osint · ThreatFox IOCs for 2025-06-16

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 130

security.cleodgiflaoer.comUnknown malware payload delivery domain (confidence level: 100%)
emeoxm.comUnknown malware payload delivery domain (confidence level: 100%)
ec2-63-33-82-34.eu-west-1.compute.amazonaws.comUnknown malware botnet C2 domain (confidence level: 100%)
down.ponjs.comUnknown malware botnet C2 domain (confidence level: 100%)
19.171.learnblockchain101.comVidar botnet C2 domain (confidence level: 100%)
izumisv1.ccMirai botnet C2 domain (confidence level: 50%)
mdnditly.gotdns.chMirai botnet C2 domain (confidence level: 50%)
qwzarterlol.ddns.netNanocore RAT botnet C2 domain (confidence level: 50%)
hackergtx-23464.portmap.ioRevenge RAT botnet C2 domain (confidence level: 50%)
cd-checking.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 50%)

URLs 104

https://emeoxm.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)
http://27.25.158.13:8088/rm1mCobalt Strike botnet C2 (confidence level: 75%)
http://a1137989.xsph.ru/57a66bf1.phpDCRat botnet C2 (confidence level: 100%)
http://162838cm.nyashvibe.ru/imagelowupdateprocessprocessorlongpollprotecttestcdn.phpDCRat botnet C2 (confidence level: 100%)
https://19.171.learnblockchain101.com/Vidar botnet C2 (confidence level: 100%)
https://78.47.118.112/Vidar botnet C2 (confidence level: 100%)
http://cf01909.tw1.ru/e54bf7d1.phpDCRat botnet C2 (confidence level: 100%)
http://706858cm.nyashvibe.ru/packetupdatewindowsdatalife.phpDCRat botnet C2 (confidence level: 100%)
http://inj3ct0rc.com/index.phpSmokeLoader botnet C2 (confidence level: 50%)
https://discord.com/api/v9/users/@meVenom RAT botnet C2 (confidence level: 50%)

IP addresses 183

45.197.149.17Cobalt Strike botnet C2 server (confidence level: 75%)
111.231.145.137Cobalt Strike botnet C2 server (confidence level: 75%)
116.205.143.204Cobalt Strike botnet C2 server (confidence level: 75%)
20.81.45.185Cobalt Strike botnet C2 server (confidence level: 75%)
34.227.71.104Cobalt Strike botnet C2 server (confidence level: 75%)
13.221.71.52Cobalt Strike botnet C2 server (confidence level: 75%)
205.209.99.214Remcos botnet C2 server (confidence level: 100%)
103.202.55.193Remcos botnet C2 server (confidence level: 100%)
193.200.16.184ShadowPad botnet C2 server (confidence level: 90%)
172.94.96.209AsyncRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-06-16

Impact

For European organizations, the impact of this threat primarily revolves around the potential for malware infiltration through network-based payload delivery mechanisms. Since the threat is associated with OSINT and network activity, it may be leveraged by attackers to identify vulnerable entry points or to distribute malicious payloads within corporate or governmental networks. The lack of specific affected products or versions limits the ability to pinpoint direct technical impacts; however, organizations could face risks including unauthorized access, data exfiltration, or disruption of services if these IOCs correspond to active malware campaigns. Given the medium severity rating and absence of known exploits, the immediate risk may be moderate, but the threat could serve as an early warning for emerging malware distribution tactics. European entities with extensive network infrastructures or those involved in critical sectors such as finance, energy, or government may be particularly sensitive to such network-based threats, as successful payload delivery could compromise confidentiality, integrity, or availability of critical systems.

Defensive guidance

1. Integrate the provided IOCs into existing security monitoring tools such as SIEM (Security Information and Event Management) and IDS/IPS (Intrusion Detection/Prevention Systems) to enhance detection capabilities for related network activity and payload delivery attempts. 2. Conduct regular network traffic analysis focusing on unusual or suspicious payload delivery patterns, especially those matching the characteristics described in the threat intelligence. 3. Employ network segmentation to limit the lateral movement potential of malware if payload delivery is successful. 4. Enhance endpoint detection and response (EDR) solutions to identify and contain malware execution linked to the observed IOCs. 5. Maintain up-to-date threat intelligence feeds and collaborate with information sharing groups to stay informed about any evolution or exploitation of these IOCs. 6. Conduct targeted phishing awareness and network hygiene training for employees to reduce the risk of initial compromise vectors that may be related to payload delivery. 7. Since no patches are available, focus on hardening network perimeter defenses and applying strict access controls to mitigate exploitation opportunities.

Community reviews

Loading reviews…