IndicatorPublished 21 Jul 2025Updated 22 Jul 2025

type osint · ThreatFox IOCs for 2025-07-21

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 49

aspotan.comAMOS payload delivery domain (confidence level: 100%)
goatramz.comAMOS payload delivery domain (confidence level: 100%)
couriontesy.comAMOS payload delivery domain (confidence level: 100%)
ekochist.comAMOS payload delivery domain (confidence level: 100%)
jupagroup.comAMOS payload delivery domain (confidence level: 100%)
vivianvalora.comAMOS payload delivery domain (confidence level: 100%)
redempti.comAMOS payload delivery domain (confidence level: 100%)
scygas.comAMOS payload delivery domain (confidence level: 100%)
laccalhdc.comAMOS payload delivery domain (confidence level: 100%)
theblumiles.comAMOS payload delivery domain (confidence level: 100%)

URLs 45

http://176.46.157.60/d8tr4u9k/login.phpAmadey botnet C2 (confidence level: 100%)
http://89.116.20.194:81/cat.shUnknown malware payload delivery URL (confidence level: 75%)
http://66.63.187.111/waaagh/login.phpAmadey botnet C2 (confidence level: 100%)
http://chongmei33.publicvm.com:7044/is-readyHoudini botnet C2 (confidence level: 100%)
http://41.216.188.92/pages/login.phpUnknown malware botnet C2 (confidence level: 100%)
http://80.66.85.195/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 75%)
https://streaming-films.xyz/tag/tag.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://streaming-films.xyz/tag/buffer.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://www.austinroofs.net/hs.ps1NetSupportManager RAT payload delivery URL (confidence level: 100%)
http://www.austinroofs.net/hsmo.zipNetSupportManager RAT payload delivery URL (confidence level: 100%)

IP addresses 244

47.94.103.189Cobalt Strike botnet C2 server (confidence level: 100%)
172.94.111.118DarkComet botnet C2 server (confidence level: 100%)
185.8.104.8Remcos botnet C2 server (confidence level: 100%)
118.195.157.204Unknown malware botnet C2 server (confidence level: 100%)
124.198.132.186AsyncRAT botnet C2 server (confidence level: 100%)
45.91.201.244Havoc botnet C2 server (confidence level: 100%)
15.197.155.86Xtreme RAT botnet C2 server (confidence level: 100%)
77.83.246.156ACR Stealer botnet C2 server (confidence level: 100%)
147.45.177.106ACR Stealer botnet C2 server (confidence level: 100%)
178.130.47.243ACR Stealer botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-21

Impact

For European organizations, the impact of this threat intelligence update is primarily informational, enabling security teams to enhance detection capabilities and prepare defenses against potential malware payloads and network-based attacks. Since no specific exploits or vulnerabilities are identified, the immediate risk to confidentiality, integrity, or availability is limited. However, the dissemination of these IOCs can help organizations identify malicious network activity early, potentially preventing more severe attacks that rely on payload delivery. The medium severity rating suggests a moderate level of concern, likely due to the potential for these IOCs to be used in targeted attacks or broader campaigns. European organizations with extensive network infrastructure and those involved in critical sectors such as finance, energy, and government should consider this intelligence valuable for proactive defense. The lack of patches or direct exploit information means that mitigation relies heavily on detection, monitoring, and incident response capabilities rather than patch management.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems and threat intelligence platforms to enhance detection of related network activity and payload delivery attempts. 2. Conduct network traffic analysis focusing on unusual or suspicious payload delivery patterns, leveraging behavioral analytics to identify anomalies. 3. Strengthen endpoint detection and response (EDR) tools to recognize and quarantine payloads associated with the threat intelligence. 4. Regularly update firewall and intrusion detection/prevention system (IDS/IPS) signatures based on the latest threat intelligence feeds, including ThreatFox. 5. Train security operations center (SOC) personnel to recognize OSINT-based reconnaissance tactics and network activity patterns that precede payload delivery. 6. Implement network segmentation and strict access controls to limit the lateral movement potential of any payloads that might be delivered. 7. Maintain robust incident response plans that incorporate the analysis of new IOCs and enable rapid containment and remediation of detected threats. 8. Collaborate with national and European cybersecurity agencies to share intelligence and receive timely updates on emerging threats.

Community reviews

Loading reviews…