IndicatorPublished 25 Jul 2025Updated 26 Jul 2025

type osint · ThreatFox IOCs for 2025-07-25

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 53

perpenab.icuLumma Stealer botnet C2 domain (confidence level: 100%)
onyxistn.betLumma Stealer botnet C2 domain (confidence level: 100%)
keulkgl.funLumma Stealer botnet C2 domain (confidence level: 100%)
passoverstruck.topUnknown malware payload delivery domain (confidence level: 100%)
vericloudix.comClearFake payload delivery domain (confidence level: 100%)
veriqcloud.comClearFake payload delivery domain (confidence level: 100%)
analyticssnoden.comUnknown malware payload delivery domain (confidence level: 100%)
security.flioreshielld.comUnknown malware payload delivery domain (confidence level: 100%)
homsertip.comUnknown malware payload delivery domain (confidence level: 100%)
pasttslv.clickHook botnet C2 domain (confidence level: 100%)

URLs 35

https://passoverstruck.top/l5t7vjqUnknown malware payload delivery URL (confidence level: 100%)
http://109.248.162.66:3100/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://aphaecv.lol/owie/apiLumma Stealer botnet C2 (confidence level: 100%)
https://keulkgl.fun/qpdlLumma Stealer botnet C2 (confidence level: 75%)
https://onyxistn.bet/xlkgLumma Stealer botnet C2 (confidence level: 75%)
https://perpenab.icu/xiutLumma Stealer botnet C2 (confidence level: 75%)
https://ucoxqdemo.fedor-turin.ru/loginLumma Stealer botnet C2 (confidence level: 50%)
https://ipmedia.info/roc/pl341/panel/admin.phpAzorult botnet C2 (confidence level: 50%)
https://server10.cdneurops.shop/Glupteba botnet C2 (confidence level: 50%)
https://server1.cdneurop.cloud/Glupteba botnet C2 (confidence level: 50%)

IP addresses 188

79.72.10.125Sliver botnet C2 server (confidence level: 100%)
120.53.122.68Sliver botnet C2 server (confidence level: 100%)
187.143.100.23Quasar RAT botnet C2 server (confidence level: 100%)
187.143.100.23Quasar RAT botnet C2 server (confidence level: 100%)
187.143.100.23Quasar RAT botnet C2 server (confidence level: 100%)
187.143.100.23Quasar RAT botnet C2 server (confidence level: 100%)
167.160.161.248Venom RAT botnet C2 server (confidence level: 100%)
81.159.248.124Venom RAT botnet C2 server (confidence level: 100%)
54.255.225.255NetSupportManager RAT botnet C2 server (confidence level: 100%)
54.64.166.20NetSupportManager RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-25

Impact

For European organizations, the impact of this threat is potentially moderate given its medium severity rating and focus on payload delivery via network activity. Since no specific software vulnerabilities or affected versions are identified, the threat likely targets general network infrastructure or user endpoints through common attack vectors such as phishing, malicious payloads, or network-based delivery mechanisms. The lack of known exploits in the wild reduces immediate risk but does not eliminate the possibility of future exploitation. Organizations with extensive network exposure or those relying heavily on open-source intelligence tools may face increased risk of compromise or data exfiltration. The threat could lead to unauthorized access, data leakage, or disruption of services if payloads execute successfully. However, the absence of detailed indicators and exploit information suggests that the threat is not currently widespread or highly sophisticated, limiting its immediate impact on confidentiality, integrity, and availability.

Defensive guidance

Given the limited technical details, European organizations should focus on strengthening network monitoring and payload detection capabilities. Specific recommendations include: 1) Enhancing network traffic analysis to detect unusual or suspicious payload delivery attempts, leveraging advanced intrusion detection/prevention systems (IDS/IPS) tuned for emerging threats; 2) Implementing strict email and web filtering policies to reduce the risk of phishing and malicious payload delivery; 3) Conducting regular user awareness training focused on recognizing social engineering and payload delivery tactics; 4) Utilizing threat intelligence feeds, including ThreatFox and MISP, to stay updated on emerging IOCs and integrating these into security information and event management (SIEM) systems for proactive detection; 5) Applying network segmentation to limit lateral movement in case of compromise; and 6) Ensuring endpoint protection solutions are up to date with behavior-based detection capabilities to identify and block unknown payloads. Since no patches are available, emphasis should be on detection and prevention rather than remediation of vulnerabilities.

Community reviews

Loading reviews…