IndicatorPublished 10 Jul 2025Updated 11 Jul 2025

type osint · ThreatFox IOCs for 2025-07-10

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 131

ent.santutxuht.eusUnknown malware botnet C2 domain (confidence level: 100%)
privateone.no-ip.bizNjRAT botnet C2 domain (confidence level: 100%)
a.zqycftmex.cnValleyRAT botnet C2 domain (confidence level: 100%)
yk.ggdy.comValleyRAT botnet C2 domain (confidence level: 100%)
user11ghost.no-ip.orgCyberGate botnet C2 domain (confidence level: 100%)
asadeanjo.no-ip.orgCyberGate botnet C2 domain (confidence level: 100%)
d0ngol.no-ip.bizCyberGate botnet C2 domain (confidence level: 100%)
canawarz.no-ip.bizCyberGate botnet C2 domain (confidence level: 100%)
canawarz.zapto.orgCyberGate botnet C2 domain (confidence level: 100%)
canawarz.no-ip.orgCyberGate botnet C2 domain (confidence level: 100%)

URLs 16

https://91.84.109.91/sign-inUnknown Stealer botnet C2 (confidence level: 50%)
https://whitegambit.com:8080/Unknown Stealer botnet C2 (confidence level: 50%)
http://bullzeie.com/kaythri.com/panel/gate.phpPony botnet C2 (confidence level: 50%)
http://a0751745.xsph.ru/_defaultwindows.phpDCRat botnet C2 (confidence level: 100%)
http://195.177.94.84/300/pin.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://89.169.13.215/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 75%)
https://ltdvjvr.top/xkaiLumma Stealer botnet C2 (confidence level: 100%)
https://antszu.top/tiuwLumma Stealer botnet C2 (confidence level: 100%)
https://deaoee.shop/goktLumma Stealer botnet C2 (confidence level: 100%)
https://clarazx.shop/aplgLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 283

47.116.124.49Cobalt Strike botnet C2 server (confidence level: 100%)
115.120.209.195Cobalt Strike botnet C2 server (confidence level: 100%)
59.110.64.250Cobalt Strike botnet C2 server (confidence level: 100%)
101.200.193.211Cobalt Strike botnet C2 server (confidence level: 100%)
45.192.99.185Ghost RAT botnet C2 server (confidence level: 100%)
45.141.215.223Remcos botnet C2 server (confidence level: 100%)
156.246.0.182Unknown malware botnet C2 server (confidence level: 100%)
156.246.7.181Unknown malware botnet C2 server (confidence level: 100%)
156.246.2.182Unknown malware botnet C2 server (confidence level: 100%)
156.246.5.185Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-10

Impact

For European organizations, the impact of this threat is currently limited due to the lack of specific exploit details or active campaigns. However, the presence of network activity and payload delivery categories suggests potential risks of malware infiltration or data exfiltration if the threat actors leverage these IOCs effectively. Organizations relying on OSINT for threat detection may benefit from incorporating these IOCs into their monitoring systems once available. The medium severity rating indicates a moderate risk, which could translate into operational disruptions or data compromise if exploited. Given the absence of known exploits and patches, the immediate risk is low, but vigilance is warranted to detect any emerging activity related to these IOCs. European entities with critical infrastructure or high-value data assets should maintain heightened awareness as threat actors often use OSINT-derived information to tailor attacks.

Defensive guidance

1. Integrate ThreatFox IOCs into existing SIEM and threat intelligence platforms to enhance detection capabilities once indicators become available. 2. Conduct regular network traffic analysis focusing on unusual payload delivery patterns or anomalous network activity that could indicate malware presence. 3. Employ advanced endpoint detection and response (EDR) solutions capable of identifying suspicious behaviors related to payload execution. 4. Maintain updated threat intelligence feeds and collaborate with information sharing groups such as CERT-EU to stay informed about evolving threats. 5. Implement strict network segmentation and least privilege access controls to limit potential lateral movement if a compromise occurs. 6. Conduct regular security awareness training emphasizing the risks of social engineering and phishing, which are common initial vectors for payload delivery. 7. Prepare incident response plans that include procedures for handling malware infections and network intrusions linked to OSINT-derived threats.

Community reviews

Loading reviews…