IndicatorPublished 28 Jul 2025Updated 29 Jul 2025

type osint · ThreatFox IOCs for 2025-07-28

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 38

maszgn.clubLumma Stealer botnet C2 domain (confidence level: 100%)
conaqr.clickLumma Stealer botnet C2 domain (confidence level: 100%)
www.coinhunters.xyzUnknown malware botnet C2 domain (confidence level: 100%)
jazper-21519.portmap.hostXWorm botnet C2 domain (confidence level: 50%)
dfsfdgsfgdsffdsg-20559.portmap.hostXWorm botnet C2 domain (confidence level: 50%)
wedding-camps.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
updates-seal.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
socmer.baoda-mouid.comRemcos botnet C2 domain (confidence level: 100%)
board-vitamins.gl.at.ply.ggQuasar RAT botnet C2 domain (confidence level: 100%)
wps.preech.topValleyRAT botnet C2 domain (confidence level: 100%)

URLs 31

https://140.143.242.109:8082/login/indexVshell botnet C2 (confidence level: 100%)
https://maszgn.club/atuw/apiLumma Stealer botnet C2 (confidence level: 100%)
https://conaqr.click/qoklLumma Stealer botnet C2 (confidence level: 100%)
http://68.64.177.239:18888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://meils.info/webpanel/login.phpDarkCloud Stealer botnet C2 (confidence level: 100%)
https://t.me/xcodertoolsUnknown Loader botnet C2 (confidence level: 50%)
https://pastebin.com/raw/efnx4tqkXWorm botnet C2 (confidence level: 50%)
https://parisforrent.top/flow/taglink.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://parisforrent.top/flow/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://cr48547.tw1.ru/7f8d8b18.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 219

68.64.177.239Unknown malware botnet C2 server (confidence level: 100%)
121.127.231.139Ghost RAT botnet C2 server (confidence level: 100%)
121.127.231.141Ghost RAT botnet C2 server (confidence level: 100%)
143.92.40.228Ghost RAT botnet C2 server (confidence level: 100%)
121.127.231.140Ghost RAT botnet C2 server (confidence level: 100%)
185.241.208.136AsyncRAT botnet C2 server (confidence level: 100%)
45.155.69.149SectopRAT botnet C2 server (confidence level: 100%)
5.161.144.140Havoc botnet C2 server (confidence level: 100%)
44.245.0.39Havoc botnet C2 server (confidence level: 100%)
54.246.253.2NetSupportManager RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-28

Impact

For European organizations, the impact of this threat is currently limited due to the lack of specific exploit details or active attack reports. However, the presence of malware-related network activity and payload delivery indicators suggests potential risks such as unauthorized access, data exfiltration, or disruption of services if the malware were to be deployed successfully. Organizations relying on OSINT feeds for threat detection may benefit from integrating these IOCs to enhance their situational awareness. The medium severity rating indicates that while the threat is not immediately critical, it warrants monitoring and preparedness to prevent escalation. Given the generic nature of the threat, the impact could vary widely depending on the malware's payload and infection vectors once more detailed information becomes available.

Defensive guidance

Given the absence of specific patches or exploit details, mitigation should focus on strengthening network monitoring and threat intelligence integration. European organizations should: 1) Incorporate updated IOCs from ThreatFox and other reputable OSINT sources into their security information and event management (SIEM) systems to detect suspicious network activity related to payload delivery. 2) Enhance network segmentation and implement strict egress filtering to limit malware communication channels. 3) Conduct regular threat hunting exercises focusing on unusual network patterns or payload delivery attempts. 4) Maintain up-to-date endpoint protection solutions capable of detecting and blocking malware payloads. 5) Train security teams to interpret OSINT-derived indicators critically and correlate them with internal telemetry for timely response. These steps go beyond generic advice by emphasizing proactive intelligence-driven detection and network controls tailored to the nature of the reported threat.

Community reviews

Loading reviews…