IndicatorPublished 16 Jul 2025Updated 17 Jul 2025

type osint · ThreatFox IOCs for 2025-07-16

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 242

deathmatchuk.comKongTuke payload delivery domain (confidence level: 100%)
warpdrive.topNetSupportManager RAT payload delivery domain (confidence level: 100%)
security.flnwareguward.comUnknown malware payload delivery domain (confidence level: 100%)
repolix.comUnknown malware payload delivery domain (confidence level: 100%)
cute-pudding-05af50.netlify.appKongTuke payload delivery domain (confidence level: 100%)
sos-atlanta.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
www.quoteconsumer.netAsyncRAT botnet C2 domain (confidence level: 100%)
m365.office.safelogins.suUnknown malware botnet C2 domain (confidence level: 100%)
funny-rhodes.194-26-192-12.plesk.pageBashlite botnet C2 domain (confidence level: 100%)
friendly-proskuriakova.194-26-192-12.plesk.pageBashlite botnet C2 domain (confidence level: 100%)

URLs 184

https://deathmatchuk.com/5l4j.jsKongTuke payload delivery URL (confidence level: 100%)
https://deathmatchuk.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
https://cute-pudding-05af50.netlify.app/file.ps1KongTuke payload delivery URL (confidence level: 100%)
https://unique-kataifi-8d2aac.netlify.app/myfiles.zipKongTuke payload delivery URL (confidence level: 100%)
https://warpdrive.top/jjj/include.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://warpdrive.top/jjj/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://sos-atlanta.com/lal.ps1NetSupportManager RAT payload delivery URL (confidence level: 100%)
https://sos-atlanta.com/vuzs.zipNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://warpdrive.top/jjj/buffer.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://sos-atlanta.com:80/lal.ps1NetSupportManager RAT payload delivery URL (confidence level: 100%)

IP addresses 178

47.245.61.75Cobalt Strike botnet C2 server (confidence level: 100%)
206.82.6.166Unknown malware botnet C2 server (confidence level: 100%)
195.206.234.19AsyncRAT botnet C2 server (confidence level: 100%)
13.41.224.200AsyncRAT botnet C2 server (confidence level: 100%)
172.111.151.97AsyncRAT botnet C2 server (confidence level: 100%)
78.162.57.179AsyncRAT botnet C2 server (confidence level: 100%)
95.111.254.223Unknown malware botnet C2 server (confidence level: 100%)
54.215.245.94NetSupportManager RAT botnet C2 server (confidence level: 100%)
54.215.245.94NetSupportManager RAT botnet C2 server (confidence level: 100%)
167.160.161.224Latrodectus botnet C2 server (confidence level: 90%)

Hashes 2

XWorm payload (confidence level: 75%)

1676e8960e5687f305e8d12a6069f92ab5e085593cea049d60fff6f0a2f451df
7d98f588fa0a8fb77dfa2b104578da98170520dfe45f66c83f5663ad26bacb03

Description

ThreatFox IOCs for 2025-07-16

Impact

For European organizations, the impact of this threat is currently limited due to the absence of known exploits and detailed technical data. However, the presence of IOCs related to payload delivery and network activity indicates potential reconnaissance or preparatory stages of malware campaigns that could lead to data exfiltration, service disruption, or unauthorized access if leveraged in targeted attacks. Organizations relying on OSINT feeds for threat intelligence can use these IOCs to enhance detection capabilities and preemptively identify suspicious network traffic or payloads. The medium severity rating suggests a moderate risk that could escalate if threat actors develop active exploits or integrate these IOCs into broader attack frameworks. European entities with critical infrastructure or high-value data assets should remain vigilant, as early detection is crucial to mitigating potential downstream impacts such as ransomware, espionage, or supply chain compromises.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection of related network activity and payload delivery attempts. 2. Conduct regular threat hunting exercises using these IOCs to identify any latent or emerging malicious activity within the network. 3. Maintain up-to-date network segmentation and strict egress filtering to limit the impact of potential payload delivery and lateral movement. 4. Employ behavioral analytics to detect anomalies in network traffic that may not match known signatures but align with the threat patterns indicated by the IOCs. 5. Educate security teams on the importance of OSINT feeds and encourage collaboration with threat intelligence sharing platforms to stay informed about evolving threats. 6. Since no patches are available, focus on proactive monitoring and incident response readiness rather than remediation. 7. Validate and enrich these IOCs with additional threat intelligence sources to improve context and prioritization of alerts.

Community reviews

Loading reviews…