IndicatorPublished 3 Jul 2025Updated 4 Jul 2025

type osint · ThreatFox IOCs for 2025-07-03

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 37

partopikoto.liveRhadamanthys botnet C2 domain (confidence level: 100%)
security.folapegiaurd.comUnknown malware payload delivery domain (confidence level: 100%)
perjaxs.comUnknown malware payload delivery domain (confidence level: 100%)
api.xiaomis.lolCobalt Strike botnet C2 domain (confidence level: 75%)
user.thinkg.ccCobalt Strike botnet C2 domain (confidence level: 75%)
1ri7zwh3k.localto.netAsyncRAT botnet C2 domain (confidence level: 50%)
namit-37666.portmap.ioAsyncRAT botnet C2 domain (confidence level: 50%)
n-survivors.gl.at.ply.ggDCRat botnet C2 domain (confidence level: 50%)
katanaa.zapto.orgMirai botnet C2 domain (confidence level: 50%)
add-adolescent.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 50%)

URLs 21

http://346720cm.nyashvibe.ru/phprequesttrafficdletemp.phpDCRat botnet C2 (confidence level: 100%)
http://110.41.44.100:8888/supershell/loginUnknown malware botnet C2 (confidence level: 50%)
https://paste.ee/r/7467kw7n/0AsyncRAT botnet C2 (confidence level: 50%)
https://pastebin.com/raw/avggnpmsDCRat botnet C2 (confidence level: 50%)
http://a1141531.xsph.ru/3c06570f.phpDCRat botnet C2 (confidence level: 100%)
http://co55281.tw1.ru/130665bb.phpDCRat botnet C2 (confidence level: 100%)
https://80.t.exifit.eu.orgVidar botnet C2 (confidence level: 75%)
https://londqx.top/xjdqLumma Stealer botnet C2 (confidence level: 100%)
https://git.xtertexter.com/viewdashboardFAKEUPDATES botnet C2 (confidence level: 100%)
https://wonxw.top/lakdLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 212

83.217.209.230Rhadamanthys botnet C2 server (confidence level: 100%)
47.100.184.216Cobalt Strike botnet C2 server (confidence level: 100%)
101.37.175.15Cobalt Strike botnet C2 server (confidence level: 100%)
27.18.19.29Cobalt Strike botnet C2 server (confidence level: 100%)
47.94.76.244Cobalt Strike botnet C2 server (confidence level: 100%)
182.160.1.146Cobalt Strike botnet C2 server (confidence level: 100%)
104.243.254.19AsyncRAT botnet C2 server (confidence level: 100%)
128.90.113.73AsyncRAT botnet C2 server (confidence level: 100%)
128.90.113.73AsyncRAT botnet C2 server (confidence level: 100%)
128.90.113.73AsyncRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-03

Impact

For European organizations, the impact of this threat is currently limited due to the lack of concrete exploit details or active campaigns. However, the presence of network activity and payload delivery tags suggests potential risks if these IOCs are used to detect or block malicious traffic. Organizations relying on OSINT for threat intelligence may benefit from integrating these IOCs into their detection systems to enhance situational awareness. The medium severity rating indicates that while immediate damage or compromise is unlikely, failure to monitor or respond to such intelligence could allow adversaries to conduct reconnaissance or prepare for more targeted attacks. European entities in sectors with high exposure to network-based threats, such as finance, critical infrastructure, and government, should remain vigilant. The absence of patches or known exploits reduces urgency but does not eliminate the need for proactive monitoring and incident response readiness.

Defensive guidance

Given the nature of this threat as an OSINT-related IOC feed without specific exploit details, mitigation should focus on enhancing detection and response capabilities rather than patching. European organizations should: 1) Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to identify suspicious network activity early. 2) Employ network segmentation and strict egress filtering to limit potential payload delivery and lateral movement. 3) Conduct regular threat hunting exercises using updated IOC feeds like ThreatFox to identify any signs of compromise. 4) Maintain up-to-date threat intelligence sharing with relevant Information Sharing and Analysis Centers (ISACs) and national cybersecurity agencies. 5) Train security teams to recognize patterns of reconnaissance and payload delivery phases to respond swiftly. 6) Ensure robust logging and monitoring of network traffic, especially for unusual outbound connections that may indicate data exfiltration or command and control communications.

Community reviews

Loading reviews…