IndicatorPublished 27 Jul 2025Updated 28 Jul 2025

type osint · ThreatFox IOCs for 2025-07-27

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 41

thinkrz.lolLumma Stealer botnet C2 domain (confidence level: 100%)
integkr.picsLumma Stealer botnet C2 domain (confidence level: 100%)
aspecqo.topLumma Stealer botnet C2 domain (confidence level: 100%)
paramkc.latLumma Stealer botnet C2 domain (confidence level: 100%)
severhi.lolLumma Stealer botnet C2 domain (confidence level: 100%)
emapsho.funLumma Stealer botnet C2 domain (confidence level: 100%)
firiaer.funLumma Stealer botnet C2 domain (confidence level: 100%)
emageuv.funLumma Stealer botnet C2 domain (confidence level: 100%)
orekcee.funLumma Stealer botnet C2 domain (confidence level: 100%)
paxrobot.digitalUnknown Stealer botnet C2 domain (confidence level: 100%)

URLs 32

http://89.116.20.194:81/telnet.shUnknown malware payload delivery URL (confidence level: 75%)
http://212.11.64.25/ohshit.shUnknown malware payload delivery URL (confidence level: 75%)
http://103.146.159.70:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://smijgub.click/zpdkLumma Stealer botnet C2 (confidence level: 75%)
http://ch25498.tw1.ru/9c2cab3e.phpDCRat botnet C2 (confidence level: 100%)
https://orienderi.com/xoriLumma Stealer botnet C2 (confidence level: 75%)
https://smp.rodeo/riww/apiLumma Stealer botnet C2 (confidence level: 75%)
https://utvp1.net/zkajLumma Stealer botnet C2 (confidence level: 75%)
https://xurekodip.com/qpdlLumma Stealer botnet C2 (confidence level: 75%)
http://146.19.215.28:4000/Unknown malware botnet C2 (confidence level: 50%)

IP addresses 128

45.138.16.131AsyncRAT botnet C2 server (confidence level: 100%)
164.92.145.34Unknown malware botnet C2 server (confidence level: 100%)
104.36.83.4Quasar RAT botnet C2 server (confidence level: 100%)
177.255.88.14DCRat botnet C2 server (confidence level: 100%)
54.183.65.116NetSupportManager RAT botnet C2 server (confidence level: 100%)
179.95.172.188NetSupportManager RAT botnet C2 server (confidence level: 100%)
115.231.171.60Xtreme RAT botnet C2 server (confidence level: 100%)
196.117.89.7XWorm botnet C2 server (confidence level: 100%)
154.222.24.214ValleyRAT botnet C2 server (confidence level: 100%)
111.230.29.245Cobalt Strike botnet C2 server (confidence level: 75%)

Description

ThreatFox IOCs for 2025-07-27

Impact

For European organizations, the impact of this threat is currently limited due to the absence of known active exploits and specific affected products or versions. However, the presence of payload delivery and network activity components indicates potential risks related to malware infections, data exfiltration, or network disruptions if these IOCs are leveraged by threat actors. Organizations relying on OSINT for threat detection may benefit from integrating these IOCs to enhance situational awareness. The medium severity suggests a moderate risk level, possibly due to the potential for targeted attacks or the use of these IOCs in broader campaigns. If exploited, impacts could include compromise of confidentiality through data theft, integrity via malware manipulation, and availability through network disruptions. European entities with significant digital infrastructure or those in sectors frequently targeted by malware campaigns (e.g., finance, critical infrastructure, government) should remain vigilant. The lack of patches or mitigation details implies that defensive measures currently rely on detection and response capabilities rather than vulnerability remediation.

Defensive guidance

Given the nature of this threat as an IOC feed without specific vulnerabilities or exploits, mitigation should focus on enhancing detection and response capabilities. European organizations should: 1) Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems and threat intelligence platforms to enable real-time monitoring and alerting. 2) Conduct network traffic analysis to identify suspicious payload delivery attempts or anomalous network activity correlating with the IOCs. 3) Strengthen endpoint detection and response (EDR) tools to detect malware behaviors associated with payload delivery. 4) Maintain robust OSINT practices to continuously update threat intelligence and adapt defenses accordingly. 5) Implement user awareness training focusing on recognizing phishing or social engineering tactics that may be used to deliver payloads. 6) Ensure network segmentation and least privilege principles to limit malware spread if an infection occurs. 7) Regularly review and update incident response plans to incorporate new intelligence from feeds like ThreatFox. These steps go beyond generic advice by emphasizing proactive IOC integration, behavioral detection, and organizational preparedness tailored to the nature of this threat intelligence.

Community reviews

Loading reviews…