IndicatorPublished 8 Jul 2025Updated 9 Jul 2025

type osint · ThreatFox IOCs for 2025-07-08

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 46

qeel.xyzLumma Stealer botnet C2 domain (confidence level: 100%)
lnofi.xyzLumma Stealer botnet C2 domain (confidence level: 100%)
ryxpq.xyzLumma Stealer botnet C2 domain (confidence level: 100%)
dzyzb.xyzLumma Stealer botnet C2 domain (confidence level: 100%)
dkkig.xyzLumma Stealer botnet C2 domain (confidence level: 100%)
lodib.xyzLumma Stealer botnet C2 domain (confidence level: 100%)
genmkh.xyzLumma Stealer botnet C2 domain (confidence level: 100%)
api.regpad.netCobalt Strike botnet C2 domain (confidence level: 75%)
apiprod.regpad.netCobalt Strike botnet C2 domain (confidence level: 75%)
cdn.bitttrrix.ruCobalt Strike botnet C2 domain (confidence level: 75%)

URLs 23

http://a1143266.xsph.ru/64e9d1b1.phpDCRat botnet C2 (confidence level: 100%)
https://leehpfe.shop/uhbvLumma Stealer botnet C2 (confidence level: 75%)
http://cz27224.tw1.ru/80e9378c.phpDCRat botnet C2 (confidence level: 100%)
https://aliondrifdions.com/work/Latrodectus botnet C2 (confidence level: 75%)
https://gorahripliys.com/work/Latrodectus botnet C2 (confidence level: 75%)
https://posbym.top/xldfLumma Stealer botnet C2 (confidence level: 75%)
https://matfqht.lat/auwqLumma Stealer botnet C2 (confidence level: 100%)
https://dkkig.xyz/xjauLumma Stealer botnet C2 (confidence level: 75%)
https://dzyzb.xyz/anbyLumma Stealer botnet C2 (confidence level: 75%)
https://genmkh.xyz/towqLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 173

115.190.147.158Cobalt Strike botnet C2 server (confidence level: 100%)
45.154.98.13Remcos botnet C2 server (confidence level: 100%)
80.64.19.202SectopRAT botnet C2 server (confidence level: 100%)
178.128.204.138Unknown malware botnet C2 server (confidence level: 100%)
128.199.152.169Havoc botnet C2 server (confidence level: 100%)
159.223.21.58Havoc botnet C2 server (confidence level: 100%)
148.66.21.236DCRat botnet C2 server (confidence level: 100%)
121.41.113.184AdaptixC2 botnet C2 server (confidence level: 100%)
34.42.252.91Empire Downloader botnet C2 server (confidence level: 100%)
147.45.218.49NetSupportManager RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-08

Impact

For European organizations, the impact of these IOCs depends largely on their integration into security monitoring and incident response workflows. Since the IOCs relate to network activity and payload delivery, organizations that rely heavily on network perimeter defenses and endpoint protection can benefit from early detection of suspicious activities. The medium severity suggests a moderate risk of intrusion or compromise if these indicators correspond to active malware campaigns. However, without specific exploit details or affected products, the direct impact remains uncertain. European entities in sectors with high exposure to network threats, such as finance, critical infrastructure, and government, should consider these IOCs as part of their broader threat intelligence to enhance situational awareness. The lack of known exploits in the wild reduces immediate risk but does not eliminate the possibility of future exploitation. Therefore, the impact is primarily in the realm of improved detection capabilities rather than an urgent operational threat.

Defensive guidance

To effectively utilize these IOCs, European organizations should integrate them into their Security Information and Event Management (SIEM) systems and threat intelligence platforms to enable automated detection and alerting. Network traffic should be monitored for the presence of these indicators, and any matches should trigger incident response procedures including containment and forensic analysis. Organizations should ensure that their endpoint detection and response (EDR) tools are updated to recognize related payload delivery methods. Regular threat hunting exercises using these IOCs can help identify latent infections or ongoing campaigns. Additionally, sharing findings with national Computer Security Incident Response Teams (CSIRTs) and participating in information sharing communities can enhance collective defense. Since no patches are available, emphasis should be placed on proactive detection and network segmentation to limit potential lateral movement. User training on recognizing phishing or social engineering attempts that could lead to payload delivery remains a critical complementary measure.

Community reviews

Loading reviews…