IndicatorPublished 31 Jul 2025Updated 1 Aug 2025

type osint · ThreatFox IOCs for 2025-07-31

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 79

akkeod.comLumma Stealer botnet C2 domain (confidence level: 100%)
security.flwaergurdar.comUnknown malware payload delivery domain (confidence level: 100%)
lomzikes.comUnknown malware payload delivery domain (confidence level: 100%)
test-at.fcsrv.netUnknown malware botnet C2 domain (confidence level: 100%)
st.atic.softlinko.comVidar botnet C2 domain (confidence level: 75%)
api.dnstools.imCobalt Strike botnet C2 domain (confidence level: 75%)
bfm2024.xyzCobalt Strike botnet C2 domain (confidence level: 75%)
etcprofile.biying007.xyzCobalt Strike botnet C2 domain (confidence level: 75%)
junk-essex-vocals-stays.trycloudflare.comCobalt Strike botnet C2 domain (confidence level: 75%)
test.betbaidu.topCobalt Strike botnet C2 domain (confidence level: 75%)

URLs 37

http://43.134.9.57:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://1.13.164.149:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://www.vastkupan.com/wp-admin/js/new%20po%20102456688.exePureLogs Stealer payload delivery URL (confidence level: 75%)
https://st.atic.softlinko.comVidar botnet C2 (confidence level: 75%)
https://synproxy.live/webpanel/panel/login.phpUnknown Stealer botnet C2 (confidence level: 50%)
https://server9.filesdumpplace.org/Glupteba botnet C2 (confidence level: 50%)
https://server12.cdneurop.cloud/Glupteba botnet C2 (confidence level: 50%)
https://server6.mastiakele.ae.org/Glupteba botnet C2 (confidence level: 50%)
https://206.81.7.57/loginUnknown Stealer botnet C2 (confidence level: 50%)
http://azaman1.xyz/index.phpAzorult botnet C2 (confidence level: 100%)

IP addresses 224

147.124.219.201PureLogs Stealer botnet C2 server (confidence level: 99%)
45.74.10.249Remcos botnet C2 server (confidence level: 99%)
85.208.84.36Remcos botnet C2 server (confidence level: 50%)
92.60.77.92Cobalt Strike botnet C2 server (confidence level: 100%)
66.42.80.45Cobalt Strike botnet C2 server (confidence level: 100%)
47.239.179.49Cobalt Strike botnet C2 server (confidence level: 100%)
103.86.44.17Ghost RAT botnet C2 server (confidence level: 100%)
43.226.17.24Ghost RAT botnet C2 server (confidence level: 100%)
91.92.120.100Remcos botnet C2 server (confidence level: 100%)
196.251.88.9Remcos botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-31

Impact

For European organizations, the impact of these ThreatFox IOCs depends largely on the nature of the underlying malware and its delivery mechanisms, which are not explicitly detailed here. Given the medium severity and the focus on network activity and payload delivery, there is a potential risk of malware infections that could lead to data exfiltration, disruption of services, or unauthorized access. The lack of known exploits in the wild and absence of patches suggests this is more of an intelligence feed rather than an active, widespread threat. However, organizations relying on network monitoring and threat detection systems can leverage these IOCs to enhance their detection capabilities. If these IOCs correspond to emerging malware campaigns targeting European infrastructure or enterprises, failure to incorporate them into security monitoring could result in delayed detection and response. The impact is thus primarily on the detection and prevention capabilities rather than direct exploitation or immediate compromise.

Defensive guidance

1. Integrate the provided ThreatFox IOCs into existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection of related network activity and payload delivery attempts. 2. Conduct regular network traffic analysis focusing on anomalies that match the IOC patterns, even if specific signatures are not fully detailed. 3. Maintain updated threat intelligence feeds and cross-reference ThreatFox IOCs with other intelligence sources to identify any emerging patterns or related threats. 4. Implement strict network segmentation and least privilege principles to limit the potential spread and impact of malware payloads if delivered. 5. Educate security teams on the importance of OSINT feeds and encourage proactive hunting for indicators matching the ThreatFox data. 6. Since no patches are available, focus on hardening network defenses, endpoint protection, and timely incident response procedures. 7. Regularly update and test incident response plans to ensure readiness against malware infections indicated by these IOCs.

Community reviews

Loading reviews…