IndicatorPublished 6 Jul 2025Updated 7 Jul 2025

type osint · ThreatFox IOCs for 2025-07-06

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 31

yu.troutbunion.betACR Stealer botnet C2 domain (confidence level: 100%)
analytics.digitalflowcloud.comCobalt Strike botnet C2 domain (confidence level: 75%)
dadanyohoocloud.comCobalt Strike botnet C2 domain (confidence level: 75%)
h.yangthousand.hairCobalt Strike botnet C2 domain (confidence level: 75%)
31.213.176.34.bc.googleusercontent.comUnknown malware botnet C2 domain (confidence level: 100%)
ozzytzy-anomali-adminjomok.panel-store-pterodactyl.my.idHavoc botnet C2 domain (confidence level: 100%)
nsxauth.duckdns.orgXWorm botnet C2 domain (confidence level: 100%)
respaldofinal.kozow.comRemcos botnet C2 domain (confidence level: 100%)
1ms0rry-35873.portmap.ioQuasar RAT botnet C2 domain (confidence level: 100%)
rrs123.no-ip.orgNjRAT botnet C2 domain (confidence level: 100%)

URLs 15

https://concvek.shop/gfhjLumma Stealer botnet C2 (confidence level: 75%)
https://t.me/xfbeh45trehgs5y4Lumma Stealer botnet C2 (confidence level: 75%)
https://triobm.xyz/tapwLumma Stealer botnet C2 (confidence level: 75%)
http://maxsim87.beget.tech/javascriptrequestsecurewpcdn.phpDCRat botnet C2 (confidence level: 100%)
http://185.82.200.174/nunu/gate.phpPony botnet C2 (confidence level: 100%)
http://49.113.78.135:8888/supershell/loginUnknown malware botnet C2 (confidence level: 50%)
http://182.92.159.149:8888/supershell/loginUnknown malware botnet C2 (confidence level: 50%)
http://150.109.78.145:8888/supershell/loginUnknown malware botnet C2 (confidence level: 50%)
http://176.46.157.50/tu3d2rom/login.phpAmadey botnet C2 (confidence level: 50%)
https://94.156.177.41/ffan/five/pvqdq929bsx_a_d_m1n_a.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 50%)

IP addresses 119

91.92.46.210Rhadamanthys botnet C2 server (confidence level: 100%)
193.32.176.103ACR Stealer botnet C2 server (confidence level: 100%)
185.76.243.212ACR Stealer botnet C2 server (confidence level: 100%)
185.76.243.209ACR Stealer botnet C2 server (confidence level: 100%)
47.92.193.143Cobalt Strike botnet C2 server (confidence level: 100%)
24.196.214.71Cobalt Strike botnet C2 server (confidence level: 100%)
172.94.9.229Remcos botnet C2 server (confidence level: 100%)
198.46.159.228Unknown malware botnet C2 server (confidence level: 100%)
128.90.113.155AsyncRAT botnet C2 server (confidence level: 100%)
103.190.107.26AsyncRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-06

Impact

Given the lack of specific exploit details or affected products, the direct impact on European organizations is likely limited at this stage. However, the dissemination of updated IOCs can aid defenders in identifying potential malicious network activity or malware infections early. European organizations that rely heavily on threat intelligence feeds for proactive defense could benefit from integrating these IOCs into their detection systems. Conversely, if these IOCs relate to emerging malware campaigns, failure to incorporate them could delay detection and response, potentially leading to data breaches or operational disruptions. The medium severity rating suggests a moderate risk, possibly reflecting the potential for network reconnaissance or initial infection stages rather than full compromise. The impact is therefore more about preparedness and situational awareness than immediate operational threat.

Defensive guidance

European organizations should ensure that their security operations centers (SOCs) and threat intelligence teams ingest and correlate the latest IOCs from reputable sources such as ThreatFox. Automated integration of these indicators into intrusion detection/prevention systems (IDS/IPS), endpoint detection and response (EDR) platforms, and network monitoring tools will enhance early detection capabilities. Regular training and updates for SOC analysts on interpreting OSINT-derived indicators can improve response times. Additionally, organizations should maintain robust network segmentation and monitoring to limit lateral movement if initial compromise occurs. Since no patches are available or required, focus should be on detection and containment strategies. Sharing any observed malicious activity related to these IOCs with trusted information sharing communities can also improve collective defense.

Community reviews

Loading reviews…