IndicatorPublished 9 Aug 2025Updated 10 Aug 2025

type osint · ThreatFox IOCs for 2025-08-09

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 33

vinsodg.topLumma Stealer botnet C2 domain (confidence level: 100%)
autodiscover.project-w.xyzHavoc botnet C2 domain (confidence level: 100%)
shareaz.allianz-courtage.coERMAC botnet C2 domain (confidence level: 100%)
pub.k22digital.my.idVidar botnet C2 domain (confidence level: 75%)
ec2-54-242-171-49.compute-1.amazonaws.comHavoc botnet C2 domain (confidence level: 100%)
xworm7.duckdns.orgXWorm botnet C2 domain (confidence level: 100%)
nameless-mouse-2f97.gogohoog546.workers.devSkuld botnet C2 domain (confidence level: 100%)
vaganetka.ruLumma Stealer botnet C2 domain (confidence level: 100%)
ichmidt.comKongTuke payload delivery domain (confidence level: 100%)
syntrva.forumLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 12

https://pub.k22digital.my.idVidar botnet C2 (confidence level: 75%)
https://smockle.top/zajrLumma Stealer botnet C2 (confidence level: 75%)
http://cz08047.tw1.ru/89ead6d7.phpDCRat botnet C2 (confidence level: 100%)
http://toxwebapp.ruStealc botnet C2 (confidence level: 100%)
http://154.201.82.47:808/db.shUnknown malware payload delivery URL (confidence level: 75%)
https://ichmidt.com/6t4r.jsKongTuke payload delivery URL (confidence level: 100%)
http://ceramic-paris-hotel.com/default.phpPony botnet C2 (confidence level: 100%)
https://sudo.polarissonic.biz.idVidar botnet C2 (confidence level: 75%)
http://116.205.188.129:54952/t8dmCobalt Strike botnet C2 (confidence level: 75%)
https://vaganetka.ru/opza/apiLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 136

47.95.9.181Cobalt Strike botnet C2 server (confidence level: 100%)
101.126.23.84Cobalt Strike botnet C2 server (confidence level: 100%)
143.92.37.188Ghost RAT botnet C2 server (confidence level: 100%)
124.198.132.19Remcos botnet C2 server (confidence level: 100%)
194.165.16.89Remcos botnet C2 server (confidence level: 100%)
216.250.249.221Remcos botnet C2 server (confidence level: 100%)
115.187.17.5Sliver botnet C2 server (confidence level: 100%)
49.113.75.75Unknown malware botnet C2 server (confidence level: 100%)
209.38.174.51Unknown malware botnet C2 server (confidence level: 100%)
196.251.92.45Venom RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-08-09

Impact

For European organizations, this threat's impact is currently limited due to the absence of known exploits in the wild and lack of specific affected products or versions. However, the presence of network activity and payload delivery components suggests a potential risk of malware infection or data exfiltration if the threat evolves or is leveraged in targeted attacks. Organizations relying on OSINT tools or monitoring network traffic for threat intelligence might detect related activity, but without actionable mitigation steps, the immediate operational impact remains low to medium. If exploited, the threat could compromise confidentiality and integrity of data, disrupt availability through payload execution, or facilitate further intrusion. The medium severity rating indicates a need for vigilance but does not imply imminent widespread harm. European entities with critical infrastructure or sensitive data should monitor developments closely, as malware threats with network delivery vectors can escalate rapidly.

Defensive guidance

Given the limited specifics, European organizations should enhance network monitoring to detect unusual payload delivery or command and control traffic, employing advanced threat detection tools that leverage updated OSINT feeds such as ThreatFox. Implement network segmentation to limit malware spread and enforce strict egress filtering to prevent unauthorized outbound connections. Regularly update and audit intrusion detection and prevention systems (IDS/IPS) to recognize emerging indicators from OSINT sources. Conduct threat hunting exercises focusing on network anomalies and payload signatures. Since no patches are available, emphasize endpoint protection with behavior-based detection and application whitelisting. Educate security teams to integrate OSINT threat intelligence into incident response workflows promptly. Collaborate with national cybersecurity centers to share and receive timely threat information. These targeted actions go beyond generic advice by focusing on proactive network defense and intelligence-driven detection.

Community reviews

Loading reviews…