IndicatorPublished 18 Jul 2025Updated 19 Jul 2025

type osint · ThreatFox IOCs for 2025-07-18

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 35

security.flegurasec.comUnknown malware payload delivery domain (confidence level: 100%)
erpoci.comUnknown malware payload delivery domain (confidence level: 100%)
m.fbwatch.liveUnknown malware botnet C2 domain (confidence level: 100%)
aafastservice.topHook botnet C2 domain (confidence level: 100%)
together-well.gl.at.ply.ggAsyncRAT botnet C2 domain (confidence level: 100%)
test.accendente.tnNjRAT botnet C2 domain (confidence level: 100%)
v2.egrfbumsu.cnValleyRAT botnet C2 domain (confidence level: 100%)
tryfancify.comAsyncRAT botnet C2 domain (confidence level: 100%)
pasotslv.shopHook botnet C2 domain (confidence level: 100%)
cooawbi.topLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 25

http://sleaqwad.shopStealc botnet C2 (confidence level: 100%)
http://ban1zons.beget.tech/95a84570.phpDCRat botnet C2 (confidence level: 100%)
https://famigh.shop/xpalLumma Stealer botnet C2 (confidence level: 75%)
http://soyasticks.club/user/joe/five/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://sleaqwad.shop/45cc90de006049c9.phpStealc botnet C2 (confidence level: 100%)
http://20.2.161.33:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://swalocf.lat/atxiLumma Stealer botnet C2 (confidence level: 100%)
https://cooawbi.top/dplaLumma Stealer botnet C2 (confidence level: 75%)
https://ourkbpw.top/aotiLumma Stealer botnet C2 (confidence level: 75%)
https://bond007.xyz/publishertag/apstag.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)

IP addresses 186

149.88.86.36Ghost RAT botnet C2 server (confidence level: 100%)
45.38.20.87Unknown malware botnet C2 server (confidence level: 100%)
5.230.34.149Unknown malware botnet C2 server (confidence level: 100%)
18.183.174.110NetSupportManager RAT botnet C2 server (confidence level: 100%)
40.177.115.50NetSupportManager RAT botnet C2 server (confidence level: 100%)
52.194.225.30NetSupportManager RAT botnet C2 server (confidence level: 100%)
3.126.10.249Xtreme RAT botnet C2 server (confidence level: 100%)
118.107.244.48Xtreme RAT botnet C2 server (confidence level: 100%)
120.221.24.103Xtreme RAT botnet C2 server (confidence level: 100%)
45.142.122.114PureLogs Stealer botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-18

Impact

For European organizations, the impact of this threat is currently assessed as medium, consistent with the provided severity rating. The potential risks include unauthorized network activity that could lead to data exfiltration, system compromise, or the delivery of additional malicious payloads. Given the lack of known exploits in the wild and no available patches, organizations may face challenges in detection and prevention. The threat's association with OSINT implies that attackers might be leveraging publicly available information to tailor attacks, increasing the risk of targeted intrusions. European entities with significant network infrastructure or those involved in sensitive sectors such as finance, government, or critical infrastructure could be at risk if the threat evolves or is leveraged in targeted campaigns. However, the current limited distribution and analysis suggest the immediate impact is contained, though vigilance is warranted.

Defensive guidance

To mitigate this threat effectively, European organizations should implement enhanced network monitoring focusing on unusual outbound traffic patterns that could indicate payload delivery or command-and-control communications. Employing advanced threat detection tools that incorporate behavioral analytics and anomaly detection can help identify subtle indicators of compromise associated with OSINT-driven attacks. Organizations should also conduct regular threat intelligence updates and integrate feeds like ThreatFox into their security operations to stay informed about emerging IOCs. Since no patches are available, emphasis should be placed on hardening network perimeters, enforcing strict access controls, and conducting employee awareness training to recognize social engineering attempts that may accompany OSINT-based attacks. Additionally, segmenting networks to limit lateral movement and maintaining robust incident response plans will reduce potential damage if an infection occurs.

Community reviews

Loading reviews…