IndicatorPublished 29 Aug 2025Updated 30 Aug 2025

type osint · ThreatFox IOCs for 2025-08-29

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 113

mityxyo4.ruClearFake payload delivery domain (confidence level: 100%)
es6featureshub.comFAKEUPDATES payload delivery domain (confidence level: 100%)
prototypechain.comFAKEUPDATES payload delivery domain (confidence level: 100%)
debuggingscripts.comFAKEUPDATES payload delivery domain (confidence level: 100%)
typescripttools.comFAKEUPDATES payload delivery domain (confidence level: 100%)
javascriptbasics.comFAKEUPDATES payload delivery domain (confidence level: 100%)
buvusio6.ruClearFake payload delivery domain (confidence level: 100%)
cudefoe9.ruClearFake payload delivery domain (confidence level: 100%)
files.taxibleapp.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
mql5.offers-special.comUnknown malware payload delivery domain (confidence level: 100%)

URLs 67

http://45.142.195.242/auth/login/Matanbuchus botnet C2 (confidence level: 100%)
http://91.236.116.22/auth/login/Matanbuchus botnet C2 (confidence level: 100%)
http://91.236.116.151/auth/login/Matanbuchus botnet C2 (confidence level: 100%)
https://files.taxibleapp.com/pixel.pngFAKEUPDATES botnet C2 (confidence level: 100%)
https://linomu.com/ajax/pixi.min.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://spider-wamp.com/res/relaxzoneNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://spider-wamp.com/share.pdbNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://spider-wamp.com/assets/img/fe99357658356062.txtNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://saocloud.icu/captcha.htmlUnknown malware payload delivery URL (confidence level: 100%)
https://nimdelcapital.com/captcha.htmlUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 1,012

185.221.215.106FAKEUPDATES payload delivery server (confidence level: 100%)
166.88.159.167FAKEUPDATES botnet C2 server (confidence level: 100%)
193.111.248.170Mirai botnet C2 server (confidence level: 100%)
213.209.143.159PureRAT botnet C2 server (confidence level: 99%)
195.26.227.209PureRAT botnet C2 server (confidence level: 77%)
155.94.155.25Unknown malware payload delivery server (confidence level: 100%)
94.154.35.115Unknown malware payload delivery server (confidence level: 100%)
94.154.35.116Unknown malware payload delivery server (confidence level: 100%)
213.252.232.249Unknown malware botnet C2 server (confidence level: 100%)
49.235.26.82Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 4

606d5c62cbf304b23b91baf7ada30fd0615a0af9788aa9dc9807226d99c29048DarkComet payload (confidence level: 100%)
8386549fa0ff312c480d080d6cfa838adacd0aadabef2dae322c7db68a49f9f0Unknown Stealer payload (confidence level: 100%)
a2254802dd387d0e0ceb61e2849a44b51879f625b89879e29592c80da9d479a2Ryuk payload (confidence level: 100%)
2497d9f86872eece699ca7263223d308827a309222ba572d385d18784b0e2144Unknown Stealer payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-08-29

Impact

Given the limited information, the potential impact on European organizations can be inferred primarily from the threat's classification as malware involved in payload delivery and network activity. Such threats typically aim to compromise confidentiality, integrity, or availability of systems by delivering malicious code that could lead to data breaches, system disruptions, or unauthorized access. European organizations, especially those relying on open-source intelligence for threat detection or operational purposes, might be targeted or indirectly affected if the malware exploits OSINT data or tools. Without specific exploit details or affected products, the impact assessment remains generalized: there is a risk of network intrusion, data exfiltration, or service disruption. The medium severity rating suggests moderate risk, implying that while the threat is not currently known to be widespread or highly destructive, it warrants attention and preparedness. The lack of known exploits in the wild reduces immediate urgency but does not eliminate future risk.

Defensive guidance

In the absence of detailed technical indicators or patches, European organizations should adopt proactive and targeted mitigation strategies beyond generic advice. These include: 1) Enhancing OSINT monitoring capabilities to detect anomalous or suspicious payload delivery attempts, leveraging threat intelligence feeds like ThreatFox for updated IOCs when available. 2) Implementing strict network segmentation and monitoring to limit the spread and impact of potential malware infections, focusing on traffic patterns associated with payload delivery and network activity. 3) Conducting regular threat hunting exercises using behavioral analytics to identify early signs of compromise related to unknown or emerging malware. 4) Ensuring endpoint protection solutions are configured to detect and block unknown or suspicious payloads, with heuristic and anomaly detection enabled. 5) Training security teams to interpret and respond to OSINT-derived threat intelligence effectively, emphasizing the importance of validating and contextualizing such data. 6) Maintaining robust incident response plans that can adapt to emerging threats lacking detailed signatures or patches. These measures collectively improve resilience against threats with limited initial intelligence.

Community reviews

Loading reviews…