IndicatorPublished 7 Jul 2025Updated 8 Jul 2025

type osint · ThreatFox IOCs for 2025-07-07

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 40

servicezqp.lolUnknown malware credit card skimming domain (confidence level: 100%)
b1.a.exifit.irVidar botnet C2 domain (confidence level: 100%)
legder-live-desktop.netUnknown malware payload delivery domain (confidence level: 100%)
forbescheck.topUnknown malware payload delivery domain (confidence level: 100%)
nnnnssss-64548.portmap.ioXWorm botnet C2 domain (confidence level: 100%)
nuevboprogreso.duckdns.orgAsyncRAT botnet C2 domain (confidence level: 100%)
296azure-64092.portmap.ioAsyncRAT botnet C2 domain (confidence level: 50%)
madara21-54023.portmap.ioDarkComet botnet C2 domain (confidence level: 50%)
uranet.duckdns.orgMirai botnet C2 domain (confidence level: 50%)
node.ozzytzy-anomali-adminjomok.panel-store-pterodactyl.my.idHavoc botnet C2 domain (confidence level: 100%)

URLs 21

http://89.35.130.147:58819/983a7643.phpDCRat botnet C2 (confidence level: 100%)
http://a0747299.xsph.ru/_defaultwindows.phpDCRat botnet C2 (confidence level: 100%)
https://b1.a.exifit.ir/Vidar botnet C2 (confidence level: 100%)
https://116.202.182.34/Vidar botnet C2 (confidence level: 100%)
https://parcel-tracks.live/apiLumma Stealer botnet C2 (confidence level: 100%)
http://a1055919.xsph.ru/84c32770.phpDCRat botnet C2 (confidence level: 50%)
http://inventscience.st:443/hsiyCobalt Strike botnet C2 (confidence level: 75%)
http://inventscience.st:443/jcoaCobalt Strike botnet C2 (confidence level: 75%)
http://a1144817.xsph.ru/1e3e1c5f.phpDCRat botnet C2 (confidence level: 100%)
https://lbkequityexchange.com/eqtrn.exeAsyncRAT payload delivery URL (confidence level: 100%)

IP addresses 164

189.1.226.116Cobalt Strike botnet C2 server (confidence level: 100%)
114.132.190.235Ghost RAT botnet C2 server (confidence level: 100%)
128.90.115.156AsyncRAT botnet C2 server (confidence level: 100%)
196.251.116.62AsyncRAT botnet C2 server (confidence level: 100%)
103.230.69.188Unknown malware botnet C2 server (confidence level: 100%)
5.181.2.21Havoc botnet C2 server (confidence level: 100%)
52.167.137.175Havoc botnet C2 server (confidence level: 100%)
35.180.203.168NetSupportManager RAT botnet C2 server (confidence level: 100%)
13.233.168.184NetSupportManager RAT botnet C2 server (confidence level: 100%)
134.209.207.184Bashlite botnet C2 server (confidence level: 100%)

Hashes 2

7482d1cece44511ee978f8d418040867Nitrogen Loader payload (confidence level: 50%)
08759d9ea2712d693891c870bbebbde3Unknown malware payload (confidence level: 50%)

Description

ThreatFox IOCs for 2025-07-07

Impact

For European organizations, the impact of these IOCs depends largely on their ability to integrate and act upon this threat intelligence within their security monitoring frameworks. Since no specific exploited vulnerabilities or malware payload details are provided, the direct risk is moderate. However, the presence of network activity and payload delivery tags suggests potential risks of intrusion attempts or malware infections if these indicators correspond to active campaigns. Organizations relying on OSINT feeds for threat detection can use these IOCs to enhance their detection capabilities and potentially prevent compromise. The lack of known exploits in the wild reduces immediate urgency, but the medium severity rating indicates that vigilance is warranted. European entities with critical infrastructure or sensitive data may face increased risk if these IOCs relate to targeted campaigns, especially if attackers leverage these indicators to bypass defenses or deliver payloads.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enable real-time detection of related network activity. 2. Conduct regular threat hunting exercises using these IOCs to identify any signs of compromise or suspicious payload delivery attempts within the network. 3. Enhance network segmentation and implement strict egress filtering to limit the potential spread or communication of malicious payloads. 4. Maintain up-to-date endpoint protection solutions capable of detecting and blocking payloads associated with these indicators. 5. Train security teams to recognize and respond to network activity patterns consistent with the provided threat intelligence. 6. Collaborate with national and European cybersecurity information sharing organizations to contextualize these IOCs within broader threat landscapes. 7. Since no patches are available, focus on detection and response capabilities rather than remediation of software vulnerabilities.

Community reviews

Loading reviews…