IndicatorPublished 2 Aug 2025Updated 3 Aug 2025

type osint · ThreatFox IOCs for 2025-08-02

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 112

bmw320ikaka.coUnknown RAT botnet C2 domain (confidence level: 75%)
security.flenieregurd.comUnknown malware payload delivery domain (confidence level: 100%)
wensibelo.comUnknown malware payload delivery domain (confidence level: 100%)
logandlog.ddns.netCobalt Strike botnet C2 domain (confidence level: 75%)
flexreplicahafailoverserver638891307695968072.rs-313704a4e866.postgres.database.azure.comUnknown malware botnet C2 domain (confidence level: 100%)
flexreplicahafailoverserver638891307695968072.postgres.database.azure.comUnknown malware botnet C2 domain (confidence level: 100%)
pvpz-th.comXWorm botnet C2 domain (confidence level: 100%)
study-leasing.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
schedule-pci.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
vestcast.coRemcos botnet C2 domain (confidence level: 100%)

URLs 75

https://egomdbj.asia/zkjr/apiLumma Stealer botnet C2 (confidence level: 100%)
https://server13.localstats.org/Glupteba botnet C2 (confidence level: 50%)
https://server10.cdneurops.buzz/Glupteba botnet C2 (confidence level: 50%)
https://server15.cdneurops.buzz/Glupteba botnet C2 (confidence level: 50%)
https://45.154.13.94/Unknown malware botnet C2 (confidence level: 50%)
http://www.03bub.vip/rk29/Formbook botnet C2 (confidence level: 50%)
http://www.2learn.net/rk29/Formbook botnet C2 (confidence level: 50%)
http://www.2zpi6.top/rk29/Formbook botnet C2 (confidence level: 50%)
http://www.58p.top/rk29/Formbook botnet C2 (confidence level: 50%)
http://www.8051.pro/rk29/Formbook botnet C2 (confidence level: 50%)

IP addresses 159

47.99.94.41Cobalt Strike botnet C2 server (confidence level: 100%)
156.238.233.49Cobalt Strike botnet C2 server (confidence level: 100%)
137.131.24.201Cobalt Strike botnet C2 server (confidence level: 100%)
45.204.211.62Ghost RAT botnet C2 server (confidence level: 100%)
182.16.33.132Ghost RAT botnet C2 server (confidence level: 100%)
45.204.222.45Ghost RAT botnet C2 server (confidence level: 100%)
103.127.126.231Ghost RAT botnet C2 server (confidence level: 100%)
43.251.116.171Ghost RAT botnet C2 server (confidence level: 100%)
89.238.176.4Remcos botnet C2 server (confidence level: 100%)
64.227.26.223Sliver botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-08-02

Impact

Given the lack of specific exploit details, affected products, or active exploitation reports, the immediate impact on European organizations is minimal. The IOCs serve primarily as detection tools to enhance situational awareness and threat hunting capabilities. Organizations leveraging these IOCs can improve their network monitoring and incident response but are not facing an imminent or direct threat from this data alone. The medium severity rating likely reflects the general importance of maintaining updated threat intelligence rather than indicating a critical or high-impact event. Therefore, the impact is primarily on the operational security posture and preparedness rather than on confidentiality, integrity, or availability of systems.

Defensive guidance

Organizations should integrate these IOCs into their existing security monitoring platforms such as SIEMs, IDS/IPS, and endpoint detection tools to enhance detection capabilities. Regularly updating threat intelligence feeds and correlating them with internal logs can help identify potential malicious activity early. Since no patches or exploits are associated, focus should be on proactive monitoring and incident response readiness. Additionally, security teams should validate the relevance of these IOCs within their specific network context to reduce false positives. Collaboration with information sharing groups and continuous training on interpreting OSINT feeds will further improve the effectiveness of these indicators.

Community reviews

Loading reviews…