IndicatorPublished 23 Jul 2025Updated 24 Jul 2025

type osint · ThreatFox IOCs for 2025-07-23

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 37

jaclwdc.topLumma Stealer botnet C2 domain (confidence level: 50%)
jfbd.comUnknown malware payload delivery domain (confidence level: 100%)
hydrillageardes.shopACR Stealer payload delivery domain (confidence level: 100%)
casulahobbuoies.shopACR Stealer payload delivery domain (confidence level: 100%)
otterspromisdes.shopACR Stealer payload delivery domain (confidence level: 100%)
outdonefurniturders.shopACR Stealer payload delivery domain (confidence level: 100%)
stompinggrounders.shopACR Stealer payload delivery domain (confidence level: 100%)
proxybuilderservice.comFAKEUPDATES payload delivery domain (confidence level: 100%)
eartheea.lifeLumma Stealer botnet C2 domain (confidence level: 100%)
glassma.liveLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 34

https://jfbd.com/f/cUnknown malware payload delivery URL (confidence level: 100%)
https://www.jfbd.com/f/fUnknown malware payload delivery URL (confidence level: 100%)
http://logickplatformsystems.boats:8080/updater?for=5120d3fedd36eac912db54c863ce59bbUnknown malware botnet C2 (confidence level: 100%)
http://a0595798.xsph.ru/asynccdn.phpDCRat botnet C2 (confidence level: 100%)
https://eartheea.life/itizLumma Stealer botnet C2 (confidence level: 75%)
https://glassma.live/alpzLumma Stealer botnet C2 (confidence level: 75%)
https://dev.ip.organica.tvVidar botnet C2 (confidence level: 75%)
https://stranzv.pics/xlaoLumma Stealer botnet C2 (confidence level: 100%)
https://securemega.xyzStealc botnet C2 (confidence level: 100%)
http://www.chrome-update.pro/morph.phpUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 227

194.213.18.89Broomstick botnet C2 server (confidence level: 100%)
47.109.58.47Cobalt Strike botnet C2 server (confidence level: 100%)
185.38.142.214Cobalt Strike botnet C2 server (confidence level: 100%)
101.34.66.77Cobalt Strike botnet C2 server (confidence level: 100%)
194.48.248.59Sliver botnet C2 server (confidence level: 100%)
52.91.190.99Sliver botnet C2 server (confidence level: 100%)
172.111.248.132AsyncRAT botnet C2 server (confidence level: 100%)
124.198.132.250AsyncRAT botnet C2 server (confidence level: 100%)
84.32.190.72Unknown malware botnet C2 server (confidence level: 100%)
102.117.167.7Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-23

Impact

For European organizations, the impact of this threat is currently limited due to the lack of detailed indicators, known exploits, or affected software versions. The medium severity rating suggests a moderate risk, potentially involving malware delivery through network activity. If exploited, such threats could lead to unauthorized access, data exfiltration, or disruption of services. However, without specific payload details or targeted vulnerabilities, the immediate risk is uncertain. Organizations relying on OSINT feeds like ThreatFox may use this information to enhance their threat detection capabilities. The threat's distribution level indicates it may be moderately widespread, so European entities with extensive network exposure or those in sectors frequently targeted by malware campaigns (e.g., finance, critical infrastructure) should remain vigilant. The lack of patches or mitigation details means that defensive measures must focus on detection and prevention rather than remediation of a known vulnerability.

Defensive guidance

Given the limited technical details, European organizations should focus on enhancing network monitoring and threat intelligence integration. Specific recommendations include: 1) Incorporate ThreatFox and similar OSINT feeds into Security Information and Event Management (SIEM) systems to detect emerging IOCs promptly. 2) Strengthen network perimeter defenses, including intrusion detection/prevention systems (IDS/IPS) configured to identify suspicious payload delivery patterns. 3) Conduct regular threat hunting exercises focusing on anomalous network activity that could indicate malware delivery attempts. 4) Maintain up-to-date endpoint protection solutions capable of detecting and blocking malware payloads. 5) Educate security teams on interpreting OSINT data and correlating it with internal telemetry for early warning. 6) Implement strict network segmentation and least privilege principles to limit potential malware spread if an infection occurs. 7) Since no patches are available, prioritize proactive detection and containment strategies over reactive patching.

Community reviews

Loading reviews…