IndicatorPublished 8 Sep 2025Updated 9 Sep 2025

type osint · ThreatFox IOCs for 2025-09-08

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 205

eotoatotlasldkd.comUnknown malware payload delivery domain (confidence level: 100%)
oaszasktktaktl.comUnknown malware payload delivery domain (confidence level: 100%)
soinpharmaceuticals.comUnknown malware payload delivery domain (confidence level: 100%)
levonpharma.comUnknown malware payload delivery domain (confidence level: 100%)
rst.lypelya2.ruClearFake payload delivery domain (confidence level: 100%)
ncloud.icuUnknown malware payload delivery domain (confidence level: 100%)
to.pobinei39.ruClearFake payload delivery domain (confidence level: 100%)
csp.jocijyu.ruClearFake payload delivery domain (confidence level: 100%)
dtc.jocijyu.ruClearFake payload delivery domain (confidence level: 100%)
me.pobinei39.ruClearFake payload delivery domain (confidence level: 100%)

URLs 121

http://94.154.35.115/user_profiles_photo/cptch.binUnknown malware payload delivery URL (confidence level: 100%)
https://db.vm.masterclasstonewow.comVidar botnet C2 (confidence level: 75%)
https://t.me/romalabs3Lumma Stealer botnet C2 (confidence level: 75%)
https://realist.qpon/eqllLumma Stealer botnet C2 (confidence level: 75%)
https://116.203.2.250Vidar botnet C2 (confidence level: 75%)
https://91.211.249.223/456e447e968afe0e.phpStealc botnet C2 (confidence level: 50%)
https://194.87.29.53/6f9307efa625dd18.phpStealc botnet C2 (confidence level: 50%)
http://77.90.153.127/c9d95c9f4c224c36.phpStealc botnet C2 (confidence level: 50%)
https://162.55.214.47/2358d131c82bf789.phpStealc botnet C2 (confidence level: 50%)
http://150.40.119.238/Hook botnet C2 (confidence level: 50%)

IP addresses 997

154.64.254.216Cobalt Strike botnet C2 server (confidence level: 100%)
178.16.52.150Latrodectus botnet C2 server (confidence level: 100%)
103.86.44.170Ghost RAT botnet C2 server (confidence level: 100%)
104.250.169.103Remcos botnet C2 server (confidence level: 100%)
196.251.70.233Remcos botnet C2 server (confidence level: 100%)
64.52.80.8AsyncRAT botnet C2 server (confidence level: 100%)
197.224.238.178Unknown malware botnet C2 server (confidence level: 100%)
193.26.115.241Quasar RAT botnet C2 server (confidence level: 100%)
52.68.99.67Brute Ratel C4 botnet C2 server (confidence level: 100%)
109.205.213.5Bashlite botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-09-08

Impact

For European organizations, the impact of this threat intelligence feed depends largely on the relevance and accuracy of the IOCs provided. If integrated effectively into security monitoring and detection systems, these IOCs can enhance the ability to detect and respond to malware-related network activity and payload delivery attempts. However, since no active exploits or specific malware campaigns are identified, the immediate risk is limited. Organizations that rely on OSINT feeds for threat hunting and incident response may benefit from early warnings, potentially reducing the dwell time of attackers. Conversely, organizations that do not consume or act on such intelligence may see minimal direct impact. The medium severity rating suggests a moderate level of concern but not an urgent or critical threat. The lack of patches or known exploits indicates that this is not a vulnerability but rather intelligence to support defensive measures.

Defensive guidance

To leverage this threat intelligence effectively, European organizations should: 1) Integrate the ThreatFox IOC feed into their Security Information and Event Management (SIEM) or threat intelligence platforms to automate detection of related indicators. 2) Correlate these IOCs with internal logs and network traffic to identify potential compromise or suspicious activity early. 3) Conduct regular threat hunting exercises using these IOCs to proactively discover hidden threats. 4) Maintain updated and comprehensive endpoint and network security controls capable of detecting payload delivery and malicious network activity. 5) Train security analysts to interpret OSINT feeds critically, understanding the context and confidence levels of the intelligence. 6) Collaborate with industry Information Sharing and Analysis Centers (ISACs) to validate and enrich the intelligence. Since no patches or direct exploits exist, focus should remain on detection, monitoring, and incident response preparedness rather than remediation of a specific vulnerability.

Community reviews

Loading reviews…