IndicatorPublished 11 Aug 2025Updated 12 Aug 2025

type osint · ThreatFox IOCs for 2025-08-11

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 13

security.flheregurend.comUnknown malware payload delivery domain (confidence level: 100%)
abersuin.comUnknown malware payload delivery domain (confidence level: 100%)
booking-en.comUnknown Loader payload delivery domain (confidence level: 90%)
dub.polarissonic.biz.idVidar botnet C2 domain (confidence level: 75%)
pnraku.topUnknown RAT botnet C2 domain (confidence level: 100%)
data.utfoundation.netHavoc botnet C2 domain (confidence level: 100%)
ferrariworldabudhabl.comUnknown Loader payload delivery domain (confidence level: 90%)
cdnli.comCobalt Strike botnet C2 domain (confidence level: 75%)
hr.lexnational.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
roaj1om6hh5dchv0xjudgxtt0fcucdjh.scvhost.clickCobalt Strike botnet C2 domain (confidence level: 75%)

URLs 21

http://37.60.245.154:8000/app_amd64Unknown malware payload delivery URL (confidence level: 75%)
https://googletagamnager.com/js/timer.jquery.jsUnknown malware payload delivery URL (confidence level: 100%)
https://hope2bounce.com/archives/dentdevilonthemoon.epubUnknown malware payload delivery URL (confidence level: 100%)
https://cocacola-brandy.net/js/timer.jquery.jsUnknown malware payload delivery URL (confidence level: 100%)
https://hope2bounce.com/reading/onlyelite.kfxUnknown malware payload delivery URL (confidence level: 100%)
https://bialball.com/js/timer.jquery.jsUnknown malware payload delivery URL (confidence level: 100%)
https://water-termale.com/books/sunincrease.epubUnknown malware payload delivery URL (confidence level: 100%)
https://water-termale.com/books/programproject.epubUnknown malware payload delivery URL (confidence level: 100%)
https://paramountoffice-today.com/library/ritualraven.aspxUnknown malware payload delivery URL (confidence level: 100%)
https://paramountoffice-today.com/library/successblame.aspxUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 116

18.209.31.252Cobalt Strike botnet C2 server (confidence level: 100%)
209.38.214.215Cobalt Strike botnet C2 server (confidence level: 100%)
193.233.165.232Cobalt Strike botnet C2 server (confidence level: 100%)
129.211.31.181Cobalt Strike botnet C2 server (confidence level: 100%)
143.92.37.198Ghost RAT botnet C2 server (confidence level: 100%)
143.92.37.204Ghost RAT botnet C2 server (confidence level: 100%)
61.182.51.118Ghost RAT botnet C2 server (confidence level: 100%)
162.55.195.59Unknown malware botnet C2 server (confidence level: 100%)
16.171.5.39Havoc botnet C2 server (confidence level: 100%)
138.2.16.164DCRat botnet C2 server (confidence level: 100%)

Hashes 1

Unknown malware payload (confidence level: 100%)

deeb880b5c038f5560ba1080ddc2b46824a32f5b8f55b2328bd31a1f1a123b50

Description

ThreatFox IOCs for 2025-08-11

Impact

For European organizations, the impact of these IOCs depends largely on their integration into security monitoring and incident response workflows. Since these are OSINT-based indicators related to malware payload delivery and network activity, they can enhance detection capabilities against emerging threats. Without specific exploit details or active campaigns, the immediate risk is limited. However, failure to incorporate such intelligence could delay identification of malicious network traffic or payload delivery attempts, potentially allowing malware infections or data exfiltration. Organizations with mature security operations centers (SOCs) and threat intelligence teams can leverage these IOCs to improve situational awareness and preemptively block or investigate suspicious activities. Conversely, organizations lacking such capabilities may not benefit directly, potentially increasing their exposure to undetected threats. Given the medium severity and lack of known exploits, the threat is more relevant as a proactive detection measure than an immediate operational risk.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection of related malicious activities. 2. Regularly update threat intelligence feeds and ensure automated ingestion of OSINT indicators to maintain up-to-date defenses. 3. Conduct network traffic analysis focusing on anomalies that match the characteristics of the payload delivery and network activity described. 4. Train SOC analysts to recognize patterns associated with these IOCs and to escalate suspicious findings promptly. 5. Implement network segmentation and strict egress filtering to limit the impact of potential payload delivery and lateral movement. 6. Maintain robust incident response plans that incorporate threat intelligence updates for timely containment and remediation. 7. Collaborate with information sharing organizations and national cybersecurity centers to contextualize these IOCs within broader threat landscapes.

Community reviews

Loading reviews…