IndicatorPublished 19 Aug 2025Updated 20 Aug 2025

type osint · ThreatFox IOCs for 2025-08-19

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 58

is-www.comUnknown Loader payload delivery domain (confidence level: 90%)
www.is-www.comUnknown Loader payload delivery domain (confidence level: 90%)
in-www.comUnknown Loader payload delivery domain (confidence level: 90%)
www.in-www.comUnknown Loader payload delivery domain (confidence level: 90%)
americovespucci.shopStealc botnet C2 domain (confidence level: 50%)
venamst.topLumma Stealer botnet C2 domain (confidence level: 100%)
bootasactive.icuMirai botnet C2 domain (confidence level: 100%)
is-www.comUnknown Loader payload delivery domain (confidence level: 90%)
www.is-www.comUnknown Loader payload delivery domain (confidence level: 90%)
www.in-www.comUnknown Loader payload delivery domain (confidence level: 90%)

URLs 36

http://23.146.184.21/adb.shUnknown malware payload delivery URL (confidence level: 75%)
http://americovespucci.shop/45cc90de006049c9.phpStealc botnet C2 (confidence level: 100%)
https://venamst.top/ooawLumma Stealer botnet C2 (confidence level: 100%)
http://196.251.80.130:4565/wget.shUnknown malware payload delivery URL (confidence level: 75%)
https://falconmx.top/wwwap/sunnydayUnknown malware payload delivery URL (confidence level: 100%)
https://revise-akmo.com/ajax/pixi.min.jsUnknown malware payload delivery URL (confidence level: 100%)
https://wi2ns.com/res/ratefeatureUnknown malware payload delivery URL (confidence level: 100%)
https://b.dev.drakeinternationalagency.comVidar botnet C2 (confidence level: 75%)
http://206.245.167.38:9999/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://www.epifonica.com/wp-content/plugins/wp-containment-means/?r=bd1odhrwczovl2rxcmridi5jb20vLatrodectus payload delivery URL (confidence level: 95%)

IP addresses 188

116.203.166.184Vidar botnet C2 server (confidence level: 100%)
94.154.35.109Mirai botnet C2 server (confidence level: 100%)
94.154.35.109Mirai botnet C2 server (confidence level: 100%)
160.30.231.250Cobalt Strike botnet C2 server (confidence level: 100%)
98.159.110.66Cobalt Strike botnet C2 server (confidence level: 100%)
112.196.218.3Ghost RAT botnet C2 server (confidence level: 100%)
45.204.211.26Ghost RAT botnet C2 server (confidence level: 100%)
172.111.137.67Remcos botnet C2 server (confidence level: 100%)
94.154.35.190Remcos botnet C2 server (confidence level: 100%)
198.135.50.115Remcos botnet C2 server (confidence level: 100%)

Hashes 1

Unknown Stealer payload (confidence level: 100%)

7c63a1520ce81dc43d2170ef1570b49627655d33e4987be2cccf8e99d9d4c99f

Description

ThreatFox IOCs for 2025-08-19

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing situational awareness and improving detection capabilities rather than responding to an immediate active threat. The medium severity suggests that while the IOCs may help identify malicious activity, they do not correspond to a critical or widespread exploit currently affecting systems. European entities that rely on threat intelligence feeds for network defense, incident response, and security monitoring can leverage these IOCs to better detect potential payload delivery attempts or network-based malware activity. However, since no specific vulnerabilities or exploits are detailed, the direct impact on confidentiality, integrity, or availability of systems is limited unless these IOCs correlate with ongoing or emerging attacks. Organizations with mature security operations centers (SOCs) and threat hunting teams can integrate these IOCs into their detection tools to preemptively identify suspicious activity. The lack of patch availability and known exploits in the wild reduces the urgency but underscores the importance of continuous monitoring and intelligence-driven defense.

Defensive guidance

Given the nature of this threat intelligence update, practical mitigation steps for European organizations include: 1) Integrate the provided IOCs into existing security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection of related malicious activity. 2) Conduct regular threat hunting exercises using these IOCs to identify any signs of payload delivery or network activity associated with the malware. 3) Maintain up-to-date network segmentation and strict access controls to limit the potential spread of malware if detected. 4) Ensure that security teams are trained to interpret and act on OSINT-based threat intelligence feeds effectively. 5) Collaborate with national and European cybersecurity information sharing organizations to contextualize these IOCs within broader threat landscapes. 6) Since no patches are available, emphasize proactive detection and response rather than remediation of a specific vulnerability. 7) Continuously monitor for updates from ThreatFox or other intelligence sources that may provide further technical details or exploit information.

Community reviews

Loading reviews…