IndicatorPublished 22 Jul 2025Updated 23 Jul 2025

type osint · ThreatFox IOCs for 2025-07-22

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 68

worlejrc.xyzLumma Stealer botnet C2 domain (confidence level: 100%)
corronxu.xyzLumma Stealer botnet C2 domain (confidence level: 100%)
security.floesrgayrd.comUnknown malware payload delivery domain (confidence level: 100%)
pelrinsz.comUnknown malware payload delivery domain (confidence level: 100%)
akacostanyaszarvas.huAmadey botnet C2 domain (confidence level: 50%)
wlldberries.proAmadey botnet C2 domain (confidence level: 50%)
calioons.topLumma Stealer botnet C2 domain (confidence level: 100%)
glossmagazine.shopUnknown Stealer botnet C2 domain (confidence level: 100%)
caq71hz7x2ccj.cfc-execute.bj.baidubce.comCobalt Strike botnet C2 domain (confidence level: 75%)
s2.mx.mottogrotto.comVidar botnet C2 domain (confidence level: 75%)

URLs 39

https://s2.mx.mottogrotto.comVidar botnet C2 (confidence level: 75%)
http://45.153.34.237/ohshit.shUnknown malware payload delivery URL (confidence level: 75%)
http://cm76089.tw1.ru/beaf3983.phpDCRat botnet C2 (confidence level: 100%)
https://amaprox.shop/Amatera botnet C2 (confidence level: 50%)
https://amaprox.shop/sign-inAmatera botnet C2 (confidence level: 50%)
https://headtechnologies.xyz/sourcetag/enroll.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://headtechnologies.xyz/sourcetag/buffer.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://clientes.sangrecreativa.com/lal1.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://www.austinroofs.net/wrbe.zipNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://civimd.top/titoLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 190

65.108.24.103PureLogs Stealer botnet C2 server (confidence level: 66%)
31.31.197.4Amadey botnet C2 server (confidence level: 25%)
144.172.101.89Cobalt Strike botnet C2 server (confidence level: 100%)
60.205.165.173Cobalt Strike botnet C2 server (confidence level: 100%)
193.112.175.148Cobalt Strike botnet C2 server (confidence level: 100%)
103.125.248.109Cobalt Strike botnet C2 server (confidence level: 100%)
167.172.188.68Sliver botnet C2 server (confidence level: 100%)
196.251.69.242AsyncRAT botnet C2 server (confidence level: 100%)
65.109.169.219Unknown malware botnet C2 server (confidence level: 100%)
34.86.63.179Quasar RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-22

Impact

For European organizations, the impact of these IOCs depends largely on their ability to detect and respond to network reconnaissance and payload delivery attempts. Since no specific exploit or malware strain is identified, the direct impact is uncertain but could include increased risk of targeted attacks if these IOCs are leveraged by threat actors to identify vulnerable systems or deliver malicious payloads. Organizations that do not integrate such OSINT feeds into their security monitoring may miss early signs of intrusion attempts, potentially leading to data breaches, service disruptions, or lateral movement within networks. The medium severity suggests a moderate risk level, implying that while immediate damage is unlikely, the threat could facilitate more serious attacks if not addressed. European entities with critical infrastructure, government networks, or industries with high-value data could be more sensitive to such reconnaissance and payload delivery activities, as they are common precursors to more damaging cyberattacks.

Defensive guidance

To mitigate risks associated with these IOCs, European organizations should: 1) Integrate ThreatFox and similar OSINT feeds into their Security Information and Event Management (SIEM) and intrusion detection/prevention systems (IDS/IPS) to enable real-time detection of known malicious indicators. 2) Conduct regular network traffic analysis to identify unusual patterns or connections matching the IOCs, focusing on early detection of reconnaissance or payload delivery attempts. 3) Harden network perimeters by implementing strict firewall rules, network segmentation, and zero-trust principles to limit the impact of any successful payload delivery. 4) Maintain up-to-date endpoint protection and conduct regular vulnerability assessments to reduce the attack surface that threat actors might exploit after reconnaissance. 5) Train security teams to interpret OSINT data effectively and correlate it with internal telemetry to prioritize response actions. 6) Establish incident response playbooks that include procedures for handling detections related to these IOCs, ensuring swift containment and remediation.

Community reviews

Loading reviews…