IndicatorPublished 6 Sep 2025Updated 7 Sep 2025

type osint · ThreatFox IOCs for 2025-09-06

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 96

uvw.xekifye8.ruClearFake payload delivery domain (confidence level: 100%)
st.xekifye8.ruClearFake payload delivery domain (confidence level: 100%)
pqr.xekifye8.ruClearFake payload delivery domain (confidence level: 100%)
ab.xekifye8.ruClearFake payload delivery domain (confidence level: 100%)
lm.xekifye8.ruClearFake payload delivery domain (confidence level: 100%)
wx.zicedoo8.ruClearFake payload delivery domain (confidence level: 100%)
pik.zicedoo8.ruClearFake payload delivery domain (confidence level: 100%)
ghi.zicedoo8.ruClearFake payload delivery domain (confidence level: 100%)
uv.zicedoo8.ruClearFake payload delivery domain (confidence level: 100%)
ef.zicedoo8.ruClearFake payload delivery domain (confidence level: 100%)

URLs 10

http://a1165341.xsph.ru/1922c1f4.phpDCRat botnet C2 (confidence level: 100%)
https://in.gw.hypersend.myVidar botnet C2 (confidence level: 75%)
https://dubznetwork.com/wqiiLumma Stealer botnet C2 (confidence level: 100%)
https://easybqy.qpon/zakiLumma Stealer botnet C2 (confidence level: 100%)
http://starshipcrown.shop/19b574f278f94a33.phpStealc botnet C2 (confidence level: 100%)
http://a1165370.xsph.ru/04430250.phpDCRat botnet C2 (confidence level: 100%)
http://724499cm.renyash.top/providereternalpythonrequestgeoprocessorflowerdlelocalcdn.phpDCRat botnet C2 (confidence level: 100%)
https://octanzn.bet/zaieLumma Stealer botnet C2 (confidence level: 75%)
http://pw577.castledev.ru/305c595f.phpDCRat botnet C2 (confidence level: 100%)
https://img.s3.masterclasstonewow.comVidar botnet C2 (confidence level: 75%)

IP addresses 369

178.16.52.103Mirai botnet C2 server (confidence level: 100%)
221.15.231.187Loki Password Stealer (PWS) botnet C2 server (confidence level: 75%)
154.89.189.186Cobalt Strike botnet C2 server (confidence level: 100%)
154.82.81.162Cobalt Strike botnet C2 server (confidence level: 100%)
103.176.197.29Ghost RAT botnet C2 server (confidence level: 100%)
147.124.213.155Remcos botnet C2 server (confidence level: 100%)
95.111.239.183Sliver botnet C2 server (confidence level: 100%)
104.243.37.233AsyncRAT botnet C2 server (confidence level: 100%)
45.141.215.69AsyncRAT botnet C2 server (confidence level: 100%)
144.172.108.216SectopRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-09-06

Impact

For European organizations, the impact of this threat intelligence update is indirect but valuable. The IOCs can help security teams improve detection of malware-related network activity and payload delivery attempts, potentially reducing the risk of successful intrusions. However, since no specific exploits or vulnerabilities are described, and no active campaigns are noted, the immediate risk to confidentiality, integrity, or availability is limited. The medium severity rating suggests that while the threat intelligence is relevant, it does not indicate a critical or widespread threat at this time. Organizations that integrate these IOCs into their security monitoring tools may benefit from enhanced situational awareness and earlier detection of malicious activity, which is crucial for timely incident response and mitigation.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) solutions to enhance detection capabilities. 2. Regularly update threat intelligence feeds and automate the ingestion of new IOCs to maintain up-to-date defenses. 3. Conduct network traffic analysis focusing on payload delivery patterns and suspicious network activity as indicated by the IOCs. 4. Train security operations center (SOC) personnel to recognize and respond to alerts generated by these IOCs. 5. Employ threat hunting exercises using the IOCs to proactively identify potential compromises. 6. Maintain robust incident response plans to quickly contain and remediate any detected malicious activity related to these indicators. 7. Since no patches are available, focus on detection and response rather than remediation of a specific vulnerability.

Community reviews

Loading reviews…