IndicatorPublished 30 Jul 2025Updated 31 Jul 2025

type osint · ThreatFox IOCs for 2025-07-30

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 115

security.flyaergyaurd.comUnknown malware payload delivery domain (confidence level: 100%)
gebraud.comUnknown malware payload delivery domain (confidence level: 100%)
mailmaster.storeCobalt Strike botnet C2 domain (confidence level: 100%)
v4lcs-58756.portmap.ioAsyncRAT botnet C2 domain (confidence level: 50%)
2825clerkenwell.comCobalt Strike botnet C2 domain (confidence level: 50%)
www.0utzm.topFormbook botnet C2 domain (confidence level: 50%)
www.2y.topFormbook botnet C2 domain (confidence level: 50%)
www.55124.clubFormbook botnet C2 domain (confidence level: 50%)
www.5q.topFormbook botnet C2 domain (confidence level: 50%)
www.7b0a0.clickFormbook botnet C2 domain (confidence level: 50%)

URLs 88

http://92.113.21.114:81/telnet.shUnknown malware payload delivery URL (confidence level: 75%)
https://chrowhv.click/xowqLumma Stealer botnet C2 (confidence level: 75%)
http://cr60627.tw1.ru/aeb85992.phpDCRat botnet C2 (confidence level: 100%)
http://www.0utzm.top/gw29/Formbook botnet C2 (confidence level: 50%)
http://www.2y.top/gw29/Formbook botnet C2 (confidence level: 50%)
http://www.55124.club/gw29/Formbook botnet C2 (confidence level: 50%)
http://www.5q.top/gw29/Formbook botnet C2 (confidence level: 50%)
http://www.7b0a0.click/gw29/Formbook botnet C2 (confidence level: 50%)
http://www.7fr2i.top/gw29/Formbook botnet C2 (confidence level: 50%)
http://www.9304.pro/gw29/Formbook botnet C2 (confidence level: 50%)

IP addresses 184

47.105.52.57Cobalt Strike botnet C2 server (confidence level: 100%)
103.12.149.83Cobalt Strike botnet C2 server (confidence level: 100%)
143.92.39.50Cobalt Strike botnet C2 server (confidence level: 100%)
47.92.75.44Cobalt Strike botnet C2 server (confidence level: 100%)
45.192.99.185Ghost RAT botnet C2 server (confidence level: 100%)
196.251.114.40Remcos botnet C2 server (confidence level: 100%)
172.104.110.213Sliver botnet C2 server (confidence level: 100%)
91.236.116.22Matanbuchus botnet C2 server (confidence level: 100%)
43.134.9.57Unknown malware botnet C2 server (confidence level: 100%)
164.68.120.30AsyncRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-30

Impact

For European organizations, the impact of this threat is primarily tied to the effectiveness of their threat detection and response capabilities. Since the information consists of IOCs without a specific exploit or vulnerability, the direct risk is moderate. However, if these IOCs correspond to emerging malware campaigns or payload delivery mechanisms, organizations could face risks such as unauthorized access, data exfiltration, or disruption of services if the malware is successfully deployed. The lack of known exploits in the wild suggests a lower immediate threat, but the presence of network activity indicators means that organizations with exposed network services or insufficient monitoring could be targeted for initial compromise. The impact could be more pronounced in sectors with high-value data or critical infrastructure, where even medium-level threats can lead to significant operational or reputational damage.

Defensive guidance

European organizations should integrate the provided IOCs into their existing security monitoring tools such as SIEMs, IDS/IPS, and endpoint detection and response (EDR) systems to enhance detection of related malicious activities. Regularly updating threat intelligence feeds and correlating these with internal logs can help identify early signs of compromise. Network segmentation and strict access controls can limit the spread of malware if initial infection occurs. Since no patches are available, emphasis should be placed on proactive detection and incident response readiness. Conducting threat hunting exercises using these IOCs can uncover latent infections or reconnaissance attempts. Additionally, organizations should ensure robust user awareness training to reduce the risk of successful payload delivery via phishing or social engineering, even though user interaction specifics are not detailed here. Finally, maintaining up-to-date backups and an incident response plan will mitigate potential damage if an infection occurs.

Community reviews

Loading reviews…