ThreatFox IOCs for 2025-07-27
ThreatFox IOCs for 2025-07-27
AI Analysis
Technical Summary
The provided information pertains to a set of Indicators of Compromise (IOCs) published on July 27, 2025, sourced from the ThreatFox MISP feed. The threat is categorized as malware-related, specifically involving OSINT (Open Source Intelligence), payload delivery, and network activity. However, the data lacks detailed technical specifics such as affected software versions, exploit mechanisms, or concrete indicators, and no known exploits are reported in the wild. The threat level is indicated as medium with a threatLevel score of 2 (on an unspecified scale), and distribution is noted as 3, suggesting some degree of spread or dissemination. The absence of patch availability and known exploits implies this may be an emerging or observed threat pattern rather than an active exploit targeting specific vulnerabilities. The classification under OSINT and payload delivery suggests that the threat may involve the use of publicly available information to facilitate malware delivery or network-based attacks, potentially through phishing, malicious payloads, or reconnaissance activities. The lack of CWEs and specific technical details limits the ability to precisely characterize the malware's behavior or attack vectors. Overall, this appears to be an intelligence update providing IOCs for monitoring and detection rather than a detailed vulnerability or exploit report.
Potential Impact
For European organizations, the impact of this threat is currently limited due to the absence of known active exploits and specific affected products or versions. However, the presence of payload delivery and network activity components indicates potential risks related to malware infections, data exfiltration, or network disruptions if these IOCs are leveraged by threat actors. Organizations relying on OSINT for threat detection may benefit from integrating these IOCs to enhance situational awareness. The medium severity suggests a moderate risk level, possibly due to the potential for targeted attacks or the use of these IOCs in broader campaigns. If exploited, impacts could include compromise of confidentiality through data theft, integrity via malware manipulation, and availability through network disruptions. European entities with significant digital infrastructure or those in sectors frequently targeted by malware campaigns (e.g., finance, critical infrastructure, government) should remain vigilant. The lack of patches or mitigation details implies that defensive measures currently rely on detection and response capabilities rather than vulnerability remediation.
Mitigation Recommendations
Given the nature of this threat as an IOC feed without specific vulnerabilities or exploits, mitigation should focus on enhancing detection and response capabilities. European organizations should: 1) Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems and threat intelligence platforms to enable real-time monitoring and alerting. 2) Conduct network traffic analysis to identify suspicious payload delivery attempts or anomalous network activity correlating with the IOCs. 3) Strengthen endpoint detection and response (EDR) tools to detect malware behaviors associated with payload delivery. 4) Maintain robust OSINT practices to continuously update threat intelligence and adapt defenses accordingly. 5) Implement user awareness training focusing on recognizing phishing or social engineering tactics that may be used to deliver payloads. 6) Ensure network segmentation and least privilege principles to limit malware spread if an infection occurs. 7) Regularly review and update incident response plans to incorporate new intelligence from feeds like ThreatFox. These steps go beyond generic advice by emphasizing proactive IOC integration, behavioral detection, and organizational preparedness tailored to the nature of this threat intelligence.
Affected Countries
Germany, France, United Kingdom, Netherlands, Italy, Spain, Poland
Indicators of Compromise
- url: http://89.116.20.194:81/telnet.sh
- domain: thinkrz.lol
- domain: integkr.pics
- domain: aspecqo.top
- domain: paramkc.lat
- domain: severhi.lol
- domain: emapsho.fun
- domain: firiaer.fun
- domain: emageuv.fun
- domain: orekcee.fun
- domain: paxrobot.digital
- domain: cyberdarkduck.live
- domain: security.floiregwaqrd.com
- domain: cekipolen.com
- url: http://212.11.64.25/ohshit.sh
- file: 45.138.16.131
- hash: 5555
- file: 164.92.145.34
- hash: 443
- file: 104.36.83.4
- hash: 8080
- file: 177.255.88.14
- hash: 8081
- file: 54.183.65.116
- hash: 2404
- file: 179.95.172.188
- hash: 9990
- file: 115.231.171.60
- hash: 10001
- file: 196.117.89.7
- hash: 1515
- file: 154.222.24.214
- hash: 668
- file: 111.230.29.245
- hash: 8080
- file: 175.178.34.215
- hash: 443
- file: 45.196.247.101
- hash: 8080
- file: 45.196.247.111
- hash: 8080
- file: 45.196.247.119
- hash: 8080
- file: 45.196.247.186
- hash: 8080
- file: 45.196.247.222
- hash: 8080
- file: 47.109.38.125
- hash: 8080
- url: http://103.146.159.70:8888/supershell/login/
- domain: snjofxs.top
- file: 106.52.241.166
- hash: 9999
- file: 147.182.225.244
- hash: 443
- file: 121.91.174.161
- hash: 8888
- file: 206.82.6.254
- hash: 8888
- domain: recleau.com
- file: 74.50.120.130
- hash: 8082
- domain: tswelo.com
- file: 45.147.178.44
- hash: 80
- file: 207.244.250.211
- hash: 3333
- file: 1.15.37.42
- hash: 443
- file: 138.197.83.6
- hash: 80
- file: 13.39.107.13
- hash: 3333
- file: 23.254.209.170
- hash: 3333
- file: 145.223.68.142
- hash: 3333
- file: 137.184.155.163
- hash: 3333
- domain: ip70-176-149-88.ph.ph.cox.net
- file: 45.93.8.9
- hash: 80
- file: 18.61.252.144
- hash: 11101
- file: 13.220.134.86
- hash: 9080
- file: 162.251.164.194
- hash: 10001
- url: https://smijgub.click/zpdk
- file: 193.161.193.99
- hash: 48581
- domain: is-gas.gl.at.ply.gg
- domain: nov-transport.gl.at.ply.gg
- domain: realdot.ddns.net
- file: 94.101.128.110
- hash: 6606
- file: 94.101.128.110
- hash: 7707
- file: 154.205.147.108
- hash: 6606
- file: 154.205.147.108
- hash: 7707
- file: 154.205.147.108
- hash: 8808
- domain: svhosted.duckdns.org
- url: http://ch25498.tw1.ru/9c2cab3e.php
- file: 83.229.123.46
- hash: 8888
- file: 221.209.122.14
- hash: 7777
- domain: smp.rodeo
- domain: xurekodip.com
- domain: utvp1.net
- domain: orienderi.com
- file: 172.98.23.73
- hash: 8080
- file: 209.94.58.48
- hash: 8080
- file: 24.152.36.198
- hash: 8808
- file: 107.189.26.86
- hash: 9000
- file: 196.251.118.16
- hash: 7000
- file: 3.23.92.222
- hash: 56501
- file: 103.229.190.80
- hash: 443
- file: 15.197.129.209
- hash: 443
- file: 18.252.157.3
- hash: 443
- file: 70.31.125.47
- hash: 2222
- file: 120.55.73.61
- hash: 8080
- file: 117.247.198.235
- hash: 443
- url: https://orienderi.com/xori
- url: https://smp.rodeo/riww/api
- url: https://utvp1.net/zkaj
- url: https://xurekodip.com/qpdl
- file: 3.126.37.18
- hash: 10320
- file: 3.19.222.192
- hash: 80
- file: 192.144.232.209
- hash: 4433
- domain: mareczek123-27222.portmap.host
- file: 154.94.232.213
- hash: 8080
- file: 103.86.44.179
- hash: 8080
- file: 5.10.250.242
- hash: 9000
- domain: mail.letlama.com
- file: 163.227.239.216
- hash: 6000
- file: 16.28.104.49
- hash: 37404
- file: 147.93.5.173
- hash: 80
- file: 123.60.27.219
- hash: 10001
- domain: www.expects-crucial-pest-bubble.club
- file: 45.143.167.125
- hash: 82
- file: 45.196.247.156
- hash: 8080
- file: 45.196.247.225
- hash: 8080
- file: 45.196.247.226
- hash: 8080
- file: 45.196.247.227
- hash: 8080
- file: 85.235.205.148
- hash: 443
- file: 154.219.109.235
- hash: 7000
- file: 147.185.221.30
- hash: 34037
- file: 35.156.141.157
- hash: 1337
- file: 156.226.174.175
- hash: 35342
- file: 43.248.173.156
- hash: 8080
- file: 1.170.203.163
- hash: 10000
- file: 117.72.181.104
- hash: 443
- file: 43.138.22.149
- hash: 8099
- file: 188.166.69.208
- hash: 443
- file: 102.117.169.108
- hash: 7443
- file: 176.100.37.214
- hash: 8080
- file: 51.95.70.41
- hash: 55274
- file: 93.232.98.22
- hash: 82
- file: 3.39.254.225
- hash: 11213
- file: 106.250.166.45
- hash: 5678
- file: 47.109.176.248
- hash: 444
- file: 101.43.150.197
- hash: 7443
- file: 8.137.100.162
- hash: 7011
- file: 135.116.64.145
- hash: 80
- file: 1.15.62.170
- hash: 50050
- file: 159.89.49.206
- hash: 4500
- file: 159.89.49.206
- hash: 7777
- file: 159.89.49.206
- hash: 17185
- file: 92.119.124.57
- hash: 17185
- file: 159.89.49.206
- hash: 54321
- file: 92.119.124.57
- hash: 3283
- file: 92.119.124.57
- hash: 53413
- file: 92.119.124.57
- hash: 10001
- file: 198.206.134.133
- hash: 31337
- file: 45.9.149.41
- hash: 31337
- file: 45.79.249.239
- hash: 31337
- file: 92.38.49.76
- hash: 31337
- file: 117.72.201.219
- hash: 31337
- file: 18.153.59.120
- hash: 20892
- file: 15.152.35.176
- hash: 666
- file: 56.155.101.240
- hash: 5858
- file: 176.223.138.4
- hash: 7443
- url: http://146.19.215.28:4000/
- url: http://45.147.178.44/pages/login.php
- url: http://a1078194.xsph.ru/c7caa90b.php
- url: https://www.rurusitemap.fedor-turin.ru/login
- url: https://cat.fedor-turin.ru/login
- url: https://www.rururustaging.fedor-turin.ru/login
- url: https://www.rusitemap.fedor-turin.ru/login
- url: https://rubackup.fedor-turin.ru/login
- url: https://rusitemap.fedor-turin.ru/login
- url: https://rurumap.fedor-turin.ru/login
- url: https://rurustaging.fedor-turin.ru/login
- url: https://cyberdarkduck.live/webpanel/panel/login.php
- url: https://wbarenux.pro/webpanel/panel/login.php
- url: https://185.196.8.118/webpanel/panel/login.php
- url: https://server9.mastiakele.ae.org/
- url: https://server12.filesdumpplace.org/
- url: https://server16.cdneurop.cloud/
- url: https://43ce3452-222d-4023-ab1b-980d96f5fe5b.server2.nisdably.com/
- url: https://server7.cdneurop.cloud/
- domain: brycedice0904-24065.portmap.host
- domain: doneloby12131-39622.portmap.host
- domain: xenquz-46850.portmap.host
- file: 45.144.29.222
- hash: 17722
- domain: british-perfectly.gl.at.ply.gg
- url: https://largexq.lat/xoot
- url: http://47.121.130.60:8888/supershell/login/
- url: http://101.201.174.160:8888/supershell/login/
- domain: release-deficit.gl.at.ply.gg
- domain: n-colony.gl.at.ply.gg
- domain: between-tank.gl.at.ply.gg
- domain: electronics-peaceful.gl.at.ply.gg
- file: 86.52.147.40
- hash: 6000
- domain: database-bio.gl.at.ply.gg
- file: 86.52.147.40
- hash: 666
- file: 212.11.64.13
- hash: 6000
- file: 147.185.221.30
- hash: 38215
- file: 196.251.80.112
- hash: 65500
- domain: www.ddos678.com
- domain: lol.0x504.com
- domain: botnet.iris-security.xyz
- domain: api.hammz.kapakhost.my.id
- file: 1.94.198.111
- hash: 8888
- file: 121.127.231.193
- hash: 443
- file: 121.127.231.194
- hash: 443
- file: 134.122.189.96
- hash: 14994
- file: 143.92.40.234
- hash: 443
- file: 85.9.198.149
- hash: 8080
- file: 46.173.214.64
- hash: 8888
- file: 23.237.106.61
- hash: 9999
- file: 60.204.231.230
- hash: 10001
- file: 161.35.226.130
- hash: 8888
- file: 193.161.193.99
- hash: 27222
- file: 46.246.145.99
- hash: 995
- file: 47.99.127.62
- hash: 63334
- file: 85.198.82.179
- hash: 80
- file: 149.0.16.127
- hash: 443
- url: https://rabqjz.xyz/ator
ThreatFox IOCs for 2025-07-27
Description
ThreatFox IOCs for 2025-07-27
AI-Powered Analysis
Technical Analysis
The provided information pertains to a set of Indicators of Compromise (IOCs) published on July 27, 2025, sourced from the ThreatFox MISP feed. The threat is categorized as malware-related, specifically involving OSINT (Open Source Intelligence), payload delivery, and network activity. However, the data lacks detailed technical specifics such as affected software versions, exploit mechanisms, or concrete indicators, and no known exploits are reported in the wild. The threat level is indicated as medium with a threatLevel score of 2 (on an unspecified scale), and distribution is noted as 3, suggesting some degree of spread or dissemination. The absence of patch availability and known exploits implies this may be an emerging or observed threat pattern rather than an active exploit targeting specific vulnerabilities. The classification under OSINT and payload delivery suggests that the threat may involve the use of publicly available information to facilitate malware delivery or network-based attacks, potentially through phishing, malicious payloads, or reconnaissance activities. The lack of CWEs and specific technical details limits the ability to precisely characterize the malware's behavior or attack vectors. Overall, this appears to be an intelligence update providing IOCs for monitoring and detection rather than a detailed vulnerability or exploit report.
Potential Impact
For European organizations, the impact of this threat is currently limited due to the absence of known active exploits and specific affected products or versions. However, the presence of payload delivery and network activity components indicates potential risks related to malware infections, data exfiltration, or network disruptions if these IOCs are leveraged by threat actors. Organizations relying on OSINT for threat detection may benefit from integrating these IOCs to enhance situational awareness. The medium severity suggests a moderate risk level, possibly due to the potential for targeted attacks or the use of these IOCs in broader campaigns. If exploited, impacts could include compromise of confidentiality through data theft, integrity via malware manipulation, and availability through network disruptions. European entities with significant digital infrastructure or those in sectors frequently targeted by malware campaigns (e.g., finance, critical infrastructure, government) should remain vigilant. The lack of patches or mitigation details implies that defensive measures currently rely on detection and response capabilities rather than vulnerability remediation.
Mitigation Recommendations
Given the nature of this threat as an IOC feed without specific vulnerabilities or exploits, mitigation should focus on enhancing detection and response capabilities. European organizations should: 1) Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems and threat intelligence platforms to enable real-time monitoring and alerting. 2) Conduct network traffic analysis to identify suspicious payload delivery attempts or anomalous network activity correlating with the IOCs. 3) Strengthen endpoint detection and response (EDR) tools to detect malware behaviors associated with payload delivery. 4) Maintain robust OSINT practices to continuously update threat intelligence and adapt defenses accordingly. 5) Implement user awareness training focusing on recognizing phishing or social engineering tactics that may be used to deliver payloads. 6) Ensure network segmentation and least privilege principles to limit malware spread if an infection occurs. 7) Regularly review and update incident response plans to incorporate new intelligence from feeds like ThreatFox. These steps go beyond generic advice by emphasizing proactive IOC integration, behavioral detection, and organizational preparedness tailored to the nature of this threat intelligence.
Affected Countries
For access to advanced analysis and higher rate limits, contact root@offseq.com
Technical Details
- Threat Level
- 2
- Analysis
- 1
- Distribution
- 3
- Uuid
- 02e60c51-92c4-44c6-a7cf-7b585383acf1
- Original Timestamp
- 1753660985
Indicators of Compromise
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://89.116.20.194:81/telnet.sh | Unknown malware payload delivery URL (confidence level: 75%) | |
urlhttp://212.11.64.25/ohshit.sh | Unknown malware payload delivery URL (confidence level: 75%) | |
urlhttp://103.146.159.70:8888/supershell/login/ | Unknown malware botnet C2 (confidence level: 100%) | |
urlhttps://smijgub.click/zpdk | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttp://ch25498.tw1.ru/9c2cab3e.php | DCRat botnet C2 (confidence level: 100%) | |
urlhttps://orienderi.com/xori | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://smp.rodeo/riww/api | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://utvp1.net/zkaj | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttps://xurekodip.com/qpdl | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttp://146.19.215.28:4000/ | Unknown malware botnet C2 (confidence level: 50%) | |
urlhttp://45.147.178.44/pages/login.php | Unknown malware botnet C2 (confidence level: 50%) | |
urlhttp://a1078194.xsph.ru/c7caa90b.php | DCRat botnet C2 (confidence level: 50%) | |
urlhttps://www.rurusitemap.fedor-turin.ru/login | Lumma Stealer botnet C2 (confidence level: 50%) | |
urlhttps://cat.fedor-turin.ru/login | Lumma Stealer botnet C2 (confidence level: 50%) | |
urlhttps://www.rururustaging.fedor-turin.ru/login | Lumma Stealer botnet C2 (confidence level: 50%) | |
urlhttps://www.rusitemap.fedor-turin.ru/login | Lumma Stealer botnet C2 (confidence level: 50%) | |
urlhttps://rubackup.fedor-turin.ru/login | Lumma Stealer botnet C2 (confidence level: 50%) | |
urlhttps://rusitemap.fedor-turin.ru/login | Lumma Stealer botnet C2 (confidence level: 50%) | |
urlhttps://rurumap.fedor-turin.ru/login | Lumma Stealer botnet C2 (confidence level: 50%) | |
urlhttps://rurustaging.fedor-turin.ru/login | Lumma Stealer botnet C2 (confidence level: 50%) | |
urlhttps://cyberdarkduck.live/webpanel/panel/login.php | Unknown Stealer botnet C2 (confidence level: 50%) | |
urlhttps://wbarenux.pro/webpanel/panel/login.php | Unknown Stealer botnet C2 (confidence level: 50%) | |
urlhttps://185.196.8.118/webpanel/panel/login.php | Unknown Stealer botnet C2 (confidence level: 50%) | |
urlhttps://server9.mastiakele.ae.org/ | Glupteba botnet C2 (confidence level: 50%) | |
urlhttps://server12.filesdumpplace.org/ | Glupteba botnet C2 (confidence level: 50%) | |
urlhttps://server16.cdneurop.cloud/ | Glupteba botnet C2 (confidence level: 50%) | |
urlhttps://43ce3452-222d-4023-ab1b-980d96f5fe5b.server2.nisdably.com/ | Glupteba botnet C2 (confidence level: 50%) | |
urlhttps://server7.cdneurop.cloud/ | Glupteba botnet C2 (confidence level: 50%) | |
urlhttps://largexq.lat/xoot | Lumma Stealer botnet C2 (confidence level: 75%) | |
urlhttp://47.121.130.60:8888/supershell/login/ | Unknown malware botnet C2 (confidence level: 100%) | |
urlhttp://101.201.174.160:8888/supershell/login/ | Unknown malware botnet C2 (confidence level: 100%) | |
urlhttps://rabqjz.xyz/ator | Lumma Stealer botnet C2 (confidence level: 75%) |
Domain
| Value | Description | Copy |
|---|---|---|
domainthinkrz.lol | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainintegkr.pics | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainaspecqo.top | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainparamkc.lat | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainseverhi.lol | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainemapsho.fun | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainfiriaer.fun | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainemageuv.fun | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainorekcee.fun | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainpaxrobot.digital | Unknown Stealer botnet C2 domain (confidence level: 100%) | |
domaincyberdarkduck.live | Unknown Stealer botnet C2 domain (confidence level: 100%) | |
domainsecurity.floiregwaqrd.com | Unknown malware payload delivery domain (confidence level: 100%) | |
domaincekipolen.com | Unknown malware payload delivery domain (confidence level: 100%) | |
domainsnjofxs.top | Cobalt Strike botnet C2 domain (confidence level: 100%) | |
domainrecleau.com | Unknown malware botnet C2 domain (confidence level: 100%) | |
domaintswelo.com | Havoc botnet C2 domain (confidence level: 100%) | |
domainip70-176-149-88.ph.ph.cox.net | QakBot botnet C2 domain (confidence level: 100%) | |
domainis-gas.gl.at.ply.gg | XWorm botnet C2 domain (confidence level: 100%) | |
domainnov-transport.gl.at.ply.gg | XWorm botnet C2 domain (confidence level: 100%) | |
domainrealdot.ddns.net | XWorm botnet C2 domain (confidence level: 100%) | |
domainsvhosted.duckdns.org | AsyncRAT botnet C2 domain (confidence level: 100%) | |
domainsmp.rodeo | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainxurekodip.com | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainutvp1.net | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainorienderi.com | Lumma Stealer botnet C2 domain (confidence level: 100%) | |
domainmareczek123-27222.portmap.host | XWorm botnet C2 domain (confidence level: 100%) | |
domainmail.letlama.com | Havoc botnet C2 domain (confidence level: 100%) | |
domainwww.expects-crucial-pest-bubble.club | Cobalt Strike botnet C2 domain (confidence level: 75%) | |
domainbrycedice0904-24065.portmap.host | Quasar RAT botnet C2 domain (confidence level: 50%) | |
domaindoneloby12131-39622.portmap.host | Quasar RAT botnet C2 domain (confidence level: 50%) | |
domainxenquz-46850.portmap.host | Quasar RAT botnet C2 domain (confidence level: 50%) | |
domainbritish-perfectly.gl.at.ply.gg | XWorm botnet C2 domain (confidence level: 50%) | |
domainrelease-deficit.gl.at.ply.gg | XWorm botnet C2 domain (confidence level: 100%) | |
domainn-colony.gl.at.ply.gg | XWorm botnet C2 domain (confidence level: 100%) | |
domainbetween-tank.gl.at.ply.gg | XWorm botnet C2 domain (confidence level: 100%) | |
domainelectronics-peaceful.gl.at.ply.gg | XWorm botnet C2 domain (confidence level: 100%) | |
domaindatabase-bio.gl.at.ply.gg | XWorm botnet C2 domain (confidence level: 100%) | |
domainwww.ddos678.com | Mirai botnet C2 domain (confidence level: 100%) | |
domainlol.0x504.com | Mirai botnet C2 domain (confidence level: 100%) | |
domainbotnet.iris-security.xyz | Mirai botnet C2 domain (confidence level: 100%) | |
domainapi.hammz.kapakhost.my.id | Mirai botnet C2 domain (confidence level: 100%) |
File
| Value | Description | Copy |
|---|---|---|
file45.138.16.131 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file164.92.145.34 | Unknown malware botnet C2 server (confidence level: 100%) | |
file104.36.83.4 | Quasar RAT botnet C2 server (confidence level: 100%) | |
file177.255.88.14 | DCRat botnet C2 server (confidence level: 100%) | |
file54.183.65.116 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file179.95.172.188 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file115.231.171.60 | Xtreme RAT botnet C2 server (confidence level: 100%) | |
file196.117.89.7 | XWorm botnet C2 server (confidence level: 100%) | |
file154.222.24.214 | ValleyRAT botnet C2 server (confidence level: 100%) | |
file111.230.29.245 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file175.178.34.215 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file45.196.247.101 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file45.196.247.111 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file45.196.247.119 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file45.196.247.186 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file45.196.247.222 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file47.109.38.125 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file106.52.241.166 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file147.182.225.244 | Sliver botnet C2 server (confidence level: 90%) | |
file121.91.174.161 | Unknown malware botnet C2 server (confidence level: 100%) | |
file206.82.6.254 | Unknown malware botnet C2 server (confidence level: 100%) | |
file74.50.120.130 | Hook botnet C2 server (confidence level: 100%) | |
file45.147.178.44 | Unknown malware botnet C2 server (confidence level: 100%) | |
file207.244.250.211 | Unknown malware botnet C2 server (confidence level: 100%) | |
file1.15.37.42 | Unknown malware botnet C2 server (confidence level: 100%) | |
file138.197.83.6 | Unknown malware botnet C2 server (confidence level: 100%) | |
file13.39.107.13 | Unknown malware botnet C2 server (confidence level: 100%) | |
file23.254.209.170 | Unknown malware botnet C2 server (confidence level: 100%) | |
file145.223.68.142 | Unknown malware botnet C2 server (confidence level: 100%) | |
file137.184.155.163 | Unknown malware botnet C2 server (confidence level: 100%) | |
file45.93.8.9 | Sliver botnet C2 server (confidence level: 100%) | |
file18.61.252.144 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file13.220.134.86 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file162.251.164.194 | Xtreme RAT botnet C2 server (confidence level: 100%) | |
file193.161.193.99 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file94.101.128.110 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file94.101.128.110 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file154.205.147.108 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file154.205.147.108 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file154.205.147.108 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file83.229.123.46 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file221.209.122.14 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file172.98.23.73 | Ghost RAT botnet C2 server (confidence level: 100%) | |
file209.94.58.48 | Sliver botnet C2 server (confidence level: 100%) | |
file24.152.36.198 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file107.189.26.86 | SectopRAT botnet C2 server (confidence level: 100%) | |
file196.251.118.16 | Venom RAT botnet C2 server (confidence level: 100%) | |
file3.23.92.222 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file103.229.190.80 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file15.197.129.209 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file18.252.157.3 | DeimosC2 botnet C2 server (confidence level: 75%) | |
file70.31.125.47 | QakBot botnet C2 server (confidence level: 75%) | |
file120.55.73.61 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file117.247.198.235 | Havoc botnet C2 server (confidence level: 75%) | |
file3.126.37.18 | XWorm botnet C2 server (confidence level: 100%) | |
file3.19.222.192 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file192.144.232.209 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file154.94.232.213 | Ghost RAT botnet C2 server (confidence level: 100%) | |
file103.86.44.179 | Ghost RAT botnet C2 server (confidence level: 100%) | |
file5.10.250.242 | SectopRAT botnet C2 server (confidence level: 100%) | |
file163.227.239.216 | DCRat botnet C2 server (confidence level: 100%) | |
file16.28.104.49 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file147.93.5.173 | MimiKatz botnet C2 server (confidence level: 100%) | |
file123.60.27.219 | Xtreme RAT botnet C2 server (confidence level: 100%) | |
file45.143.167.125 | Meterpreter botnet C2 server (confidence level: 75%) | |
file45.196.247.156 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file45.196.247.225 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file45.196.247.226 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file45.196.247.227 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
file85.235.205.148 | FAKEUPDATES payload delivery server (confidence level: 100%) | |
file154.219.109.235 | XWorm botnet C2 server (confidence level: 100%) | |
file147.185.221.30 | XWorm botnet C2 server (confidence level: 100%) | |
file35.156.141.157 | NjRAT botnet C2 server (confidence level: 100%) | |
file156.226.174.175 | Bashlite botnet C2 server (confidence level: 75%) | |
file43.248.173.156 | FatalRat botnet C2 server (confidence level: 100%) | |
file1.170.203.163 | GhostSocks botnet C2 server (confidence level: 100%) | |
file117.72.181.104 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file43.138.22.149 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
file188.166.69.208 | Sliver botnet C2 server (confidence level: 100%) | |
file102.117.169.108 | Unknown malware botnet C2 server (confidence level: 100%) | |
file176.100.37.214 | Orcus RAT botnet C2 server (confidence level: 100%) | |
file51.95.70.41 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file93.232.98.22 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file3.39.254.225 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
file106.250.166.45 | RMS botnet C2 server (confidence level: 100%) | |
file47.109.176.248 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
file101.43.150.197 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
file8.137.100.162 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
file135.116.64.145 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
file1.15.62.170 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
file159.89.49.206 | Xtreme RAT botnet C2 server (confidence level: 50%) | |
file159.89.49.206 | Xtreme RAT botnet C2 server (confidence level: 50%) | |
file159.89.49.206 | Xtreme RAT botnet C2 server (confidence level: 50%) | |
file92.119.124.57 | Xtreme RAT botnet C2 server (confidence level: 50%) | |
file159.89.49.206 | Xtreme RAT botnet C2 server (confidence level: 50%) | |
file92.119.124.57 | Xtreme RAT botnet C2 server (confidence level: 50%) | |
file92.119.124.57 | Xtreme RAT botnet C2 server (confidence level: 50%) | |
file92.119.124.57 | Xtreme RAT botnet C2 server (confidence level: 50%) | |
file198.206.134.133 | Sliver botnet C2 server (confidence level: 50%) | |
file45.9.149.41 | Sliver botnet C2 server (confidence level: 50%) | |
file45.79.249.239 | Sliver botnet C2 server (confidence level: 50%) | |
file92.38.49.76 | Sliver botnet C2 server (confidence level: 50%) | |
file117.72.201.219 | Sliver botnet C2 server (confidence level: 50%) | |
file18.153.59.120 | NetSupportManager RAT botnet C2 server (confidence level: 50%) | |
file15.152.35.176 | NetSupportManager RAT botnet C2 server (confidence level: 50%) | |
file56.155.101.240 | NetSupportManager RAT botnet C2 server (confidence level: 50%) | |
file176.223.138.4 | Unknown malware botnet C2 server (confidence level: 50%) | |
file45.144.29.222 | RedLine Stealer botnet C2 server (confidence level: 50%) | |
file86.52.147.40 | XWorm botnet C2 server (confidence level: 100%) | |
file86.52.147.40 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file212.11.64.13 | XWorm botnet C2 server (confidence level: 75%) | |
file147.185.221.30 | XWorm botnet C2 server (confidence level: 100%) | |
file196.251.80.112 | AsyncRAT botnet C2 server (confidence level: 100%) | |
file1.94.198.111 | ValleyRAT botnet C2 server (confidence level: 100%) | |
file121.127.231.193 | Ghost RAT botnet C2 server (confidence level: 100%) | |
file121.127.231.194 | Ghost RAT botnet C2 server (confidence level: 100%) | |
file134.122.189.96 | Ghost RAT botnet C2 server (confidence level: 100%) | |
file143.92.40.234 | Ghost RAT botnet C2 server (confidence level: 100%) | |
file85.9.198.149 | Sliver botnet C2 server (confidence level: 100%) | |
file46.173.214.64 | DCRat botnet C2 server (confidence level: 100%) | |
file23.237.106.61 | DCRat botnet C2 server (confidence level: 100%) | |
file60.204.231.230 | Xtreme RAT botnet C2 server (confidence level: 100%) | |
file161.35.226.130 | Sliver botnet C2 server (confidence level: 75%) | |
file193.161.193.99 | XWorm botnet C2 server (confidence level: 100%) | |
file46.246.145.99 | QakBot botnet C2 server (confidence level: 75%) | |
file47.99.127.62 | Sliver botnet C2 server (confidence level: 75%) | |
file85.198.82.179 | Sliver botnet C2 server (confidence level: 75%) | |
file149.0.16.127 | Meterpreter botnet C2 server (confidence level: 75%) |
Hash
| Value | Description | Copy |
|---|---|---|
hash5555 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8080 | Quasar RAT botnet C2 server (confidence level: 100%) | |
hash8081 | DCRat botnet C2 server (confidence level: 100%) | |
hash2404 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash9990 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash10001 | Xtreme RAT botnet C2 server (confidence level: 100%) | |
hash1515 | XWorm botnet C2 server (confidence level: 100%) | |
hash668 | ValleyRAT botnet C2 server (confidence level: 100%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash9999 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Sliver botnet C2 server (confidence level: 90%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8888 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8082 | Hook botnet C2 server (confidence level: 100%) | |
hash80 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash80 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash3333 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash80 | Sliver botnet C2 server (confidence level: 100%) | |
hash11101 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash9080 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash10001 | Xtreme RAT botnet C2 server (confidence level: 100%) | |
hash48581 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash6606 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash7707 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash6606 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash7707 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8888 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash7777 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8080 | Ghost RAT botnet C2 server (confidence level: 100%) | |
hash8080 | Sliver botnet C2 server (confidence level: 100%) | |
hash8808 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash9000 | SectopRAT botnet C2 server (confidence level: 100%) | |
hash7000 | Venom RAT botnet C2 server (confidence level: 100%) | |
hash56501 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash443 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash443 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash443 | DeimosC2 botnet C2 server (confidence level: 75%) | |
hash2222 | QakBot botnet C2 server (confidence level: 75%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash443 | Havoc botnet C2 server (confidence level: 75%) | |
hash10320 | XWorm botnet C2 server (confidence level: 100%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash4433 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8080 | Ghost RAT botnet C2 server (confidence level: 100%) | |
hash8080 | Ghost RAT botnet C2 server (confidence level: 100%) | |
hash9000 | SectopRAT botnet C2 server (confidence level: 100%) | |
hash6000 | DCRat botnet C2 server (confidence level: 100%) | |
hash37404 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash80 | MimiKatz botnet C2 server (confidence level: 100%) | |
hash10001 | Xtreme RAT botnet C2 server (confidence level: 100%) | |
hash82 | Meterpreter botnet C2 server (confidence level: 75%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash8080 | Cobalt Strike botnet C2 server (confidence level: 75%) | |
hash443 | FAKEUPDATES payload delivery server (confidence level: 100%) | |
hash7000 | XWorm botnet C2 server (confidence level: 100%) | |
hash34037 | XWorm botnet C2 server (confidence level: 100%) | |
hash1337 | NjRAT botnet C2 server (confidence level: 100%) | |
hash35342 | Bashlite botnet C2 server (confidence level: 75%) | |
hash8080 | FatalRat botnet C2 server (confidence level: 100%) | |
hash10000 | GhostSocks botnet C2 server (confidence level: 100%) | |
hash443 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash8099 | Cobalt Strike botnet C2 server (confidence level: 100%) | |
hash443 | Sliver botnet C2 server (confidence level: 100%) | |
hash7443 | Unknown malware botnet C2 server (confidence level: 100%) | |
hash8080 | Orcus RAT botnet C2 server (confidence level: 100%) | |
hash55274 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash82 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash11213 | NetSupportManager RAT botnet C2 server (confidence level: 100%) | |
hash5678 | RMS botnet C2 server (confidence level: 100%) | |
hash444 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
hash7443 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
hash7011 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
hash80 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
hash50050 | Cobalt Strike botnet C2 server (confidence level: 50%) | |
hash4500 | Xtreme RAT botnet C2 server (confidence level: 50%) | |
hash7777 | Xtreme RAT botnet C2 server (confidence level: 50%) | |
hash17185 | Xtreme RAT botnet C2 server (confidence level: 50%) | |
hash17185 | Xtreme RAT botnet C2 server (confidence level: 50%) | |
hash54321 | Xtreme RAT botnet C2 server (confidence level: 50%) | |
hash3283 | Xtreme RAT botnet C2 server (confidence level: 50%) | |
hash53413 | Xtreme RAT botnet C2 server (confidence level: 50%) | |
hash10001 | Xtreme RAT botnet C2 server (confidence level: 50%) | |
hash31337 | Sliver botnet C2 server (confidence level: 50%) | |
hash31337 | Sliver botnet C2 server (confidence level: 50%) | |
hash31337 | Sliver botnet C2 server (confidence level: 50%) | |
hash31337 | Sliver botnet C2 server (confidence level: 50%) | |
hash31337 | Sliver botnet C2 server (confidence level: 50%) | |
hash20892 | NetSupportManager RAT botnet C2 server (confidence level: 50%) | |
hash666 | NetSupportManager RAT botnet C2 server (confidence level: 50%) | |
hash5858 | NetSupportManager RAT botnet C2 server (confidence level: 50%) | |
hash7443 | Unknown malware botnet C2 server (confidence level: 50%) | |
hash17722 | RedLine Stealer botnet C2 server (confidence level: 50%) | |
hash6000 | XWorm botnet C2 server (confidence level: 100%) | |
hash666 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash6000 | XWorm botnet C2 server (confidence level: 75%) | |
hash38215 | XWorm botnet C2 server (confidence level: 100%) | |
hash65500 | AsyncRAT botnet C2 server (confidence level: 100%) | |
hash8888 | ValleyRAT botnet C2 server (confidence level: 100%) | |
hash443 | Ghost RAT botnet C2 server (confidence level: 100%) | |
hash443 | Ghost RAT botnet C2 server (confidence level: 100%) | |
hash14994 | Ghost RAT botnet C2 server (confidence level: 100%) | |
hash443 | Ghost RAT botnet C2 server (confidence level: 100%) | |
hash8080 | Sliver botnet C2 server (confidence level: 100%) | |
hash8888 | DCRat botnet C2 server (confidence level: 100%) | |
hash9999 | DCRat botnet C2 server (confidence level: 100%) | |
hash10001 | Xtreme RAT botnet C2 server (confidence level: 100%) | |
hash8888 | Sliver botnet C2 server (confidence level: 75%) | |
hash27222 | XWorm botnet C2 server (confidence level: 100%) | |
hash995 | QakBot botnet C2 server (confidence level: 75%) | |
hash63334 | Sliver botnet C2 server (confidence level: 75%) | |
hash80 | Sliver botnet C2 server (confidence level: 75%) | |
hash443 | Meterpreter botnet C2 server (confidence level: 75%) |
Threat ID: 6886c19cad5a09ad00776ca5
Added to database: 7/28/2025, 12:17:32 AM
Last enriched: 7/28/2025, 12:32:44 AM
Last updated: 7/29/2025, 12:12:47 PM
Views: 8
Related Threats
ThreatFox IOCs for 2025-07-28
MediumScattered Spider Launching Ransomware on Hijacked VMware Systems, Warns Google
MediumRAVEN STEALER UNMASKED: Telegram-Based Data Exfiltration
MediumThreatFox IOCs for 2025-07-26
MediumLaw enforcement operations seized BlackSuit ransomware gang’s darknet sites
MediumActions
Updates to AI analysis are available only with a Pro account. Contact root@offseq.com for access.
External Links
Need enhanced features?
Contact root@offseq.com for Pro access with improved analysis and higher rate limits.