IndicatorPublished 20 Jul 2025Updated 21 Jul 2025

type osint · ThreatFox IOCs for 2025-07-20

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 24

tip.emailsv.orgCobalt Strike botnet C2 domain (confidence level: 75%)
sworwdcp.topLumma Stealer botnet C2 domain (confidence level: 100%)
tunenrnc.topLumma Stealer botnet C2 domain (confidence level: 100%)
ultracpj.xyzLumma Stealer botnet C2 domain (confidence level: 100%)
vegemuoe.topLumma Stealer botnet C2 domain (confidence level: 100%)
domet.chanbaba.onlineMirai botnet C2 domain (confidence level: 50%)
1328175548-4zksdftd97.ap-guangzhou.tencentscf.comCobalt Strike botnet C2 domain (confidence level: 75%)
security.felaguueard.comUnknown malware payload delivery domain (confidence level: 100%)
pewbicved.comUnknown malware payload delivery domain (confidence level: 100%)
cnc.netjssaytcpp.latMirai botnet C2 domain (confidence level: 100%)

URLs 31

tcp://46.8.231.224/scripts/4thepool_miner.shUnknown malware payload delivery URL (confidence level: 75%)
https://bornim.top/xoakLumma Stealer botnet C2 (confidence level: 100%)
http://196.251.66.32/hbts/top1miku.i586Unknown malware payload delivery URL (confidence level: 75%)
http://196.251.66.32/hbts/top1miku.x86_64Unknown malware payload delivery URL (confidence level: 75%)
https://www.optionchain.dpdns.orgVidar botnet C2 (confidence level: 75%)
https://tunenrnc.top/xodzLumma Stealer botnet C2 (confidence level: 75%)
https://ultracpj.xyz/apgkLumma Stealer botnet C2 (confidence level: 75%)
https://vegemuoe.top/xauyLumma Stealer botnet C2 (confidence level: 75%)
http://glgkorea.com/forum/viewtopic.phpPony botnet C2 (confidence level: 100%)
http://195.62.49.187/providerpythonlowbigload.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 147

154.216.157.235Cobalt Strike botnet C2 server (confidence level: 100%)
139.155.104.147Cobalt Strike botnet C2 server (confidence level: 100%)
43.139.152.50ValleyRAT botnet C2 server (confidence level: 100%)
91.236.116.139Matanbuchus botnet C2 server (confidence level: 100%)
157.254.165.199AsyncRAT botnet C2 server (confidence level: 100%)
83.222.191.90SectopRAT botnet C2 server (confidence level: 100%)
172.105.121.80Unknown malware botnet C2 server (confidence level: 100%)
45.38.20.87Unknown malware botnet C2 server (confidence level: 100%)
35.244.127.70Havoc botnet C2 server (confidence level: 100%)
35.244.127.70Havoc botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-20

Impact

For European organizations, the impact of this threat is currently limited due to the absence of specific exploit details or active campaigns. However, the presence of malware-related IOCs in OSINT feeds can indicate emerging threats or reconnaissance activities that could precede targeted attacks. If these IOCs correspond to payload delivery mechanisms or network activity patterns, organizations might face risks such as unauthorized access, data exfiltration, or disruption of services if the malware is deployed successfully. The medium severity suggests a moderate risk level, which could translate into operational disruptions or confidentiality breaches if exploited. European entities relying on threat intelligence feeds like ThreatFox can benefit from early detection but must remain vigilant to evolving threats that may leverage these IOCs. The lack of patches or known exploits suggests that the threat is not currently being actively exploited at scale, reducing immediate risk but not eliminating future potential impact.

Defensive guidance

European organizations should integrate these IOCs into their existing security monitoring and threat intelligence platforms to enhance detection capabilities. Specifically, security teams should: 1) Update intrusion detection and prevention systems (IDS/IPS) and endpoint detection and response (EDR) tools with the latest IOCs from ThreatFox to identify potential malicious payload delivery or network activity. 2) Conduct network traffic analysis focusing on anomalies that match the described network activity patterns associated with these IOCs. 3) Perform regular threat hunting exercises using the provided indicators to proactively identify any signs of compromise. 4) Enhance employee awareness and training on recognizing phishing or social engineering attempts that could serve as initial infection vectors for malware payload delivery. 5) Maintain robust backup and incident response plans to mitigate potential impacts if malware infection occurs. Since no patches are available, emphasis should be placed on detection, containment, and response rather than remediation of a specific vulnerability.

Community reviews

Loading reviews…