IndicatorPublished 17 Oct 2025Updated 18 Oct 2025

ThreatFox IOCs for 2025-10-17

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 196

nova-shadow.comUnknown RAT botnet C2 domain (confidence level: 100%)
imap.dmg-tech.comUnknown malware botnet C2 domain (confidence level: 100%)
rdweb.dmg-tech.comUnknown malware botnet C2 domain (confidence level: 100%)
rka7q.fox-ab.ruClearFake payload delivery domain (confidence level: 100%)
t1mze9.fox-ab.ruClearFake payload delivery domain (confidence level: 100%)
c8y4d.fox-ab.ruClearFake payload delivery domain (confidence level: 100%)
wq3b0k7.fox-ab.ruClearFake payload delivery domain (confidence level: 100%)
b4yn.mape-3.ruClearFake payload delivery domain (confidence level: 100%)
p7e2x.mape-3.ruClearFake payload delivery domain (confidence level: 100%)
kz6t3.mape-3.ruClearFake payload delivery domain (confidence level: 100%)

URLs 160

http://170.130.55.38Stealc botnet C2 (confidence level: 100%)
https://x.f.myolt.my.id/Vidar botnet C2 (confidence level: 100%)
https://x.f.glinkeg.com/Vidar botnet C2 (confidence level: 100%)
https://p.x.myolt.my.id/Vidar botnet C2 (confidence level: 100%)
https://p.x.compuegypt.net/Vidar botnet C2 (confidence level: 100%)
https://77.105.132.216/56f47e918c5386bf.phpStealc botnet C2 (confidence level: 50%)
http://38.107.233.135/imagehttpauthcdn.phpStealc botnet C2 (confidence level: 50%)
https://amprox.click/sign-inAmatera botnet C2 (confidence level: 50%)
http://www.17752.loan/punm/Formbook botnet C2 (confidence level: 50%)
http://www.245368925.xyz/punm/Formbook botnet C2 (confidence level: 50%)

IP addresses 117

52.91.188.54Loki Password Stealer (PWS) botnet C2 server (confidence level: 75%)
206.123.150.39Nanocore RAT botnet C2 server (confidence level: 75%)
103.242.12.203Cobalt Strike botnet C2 server (confidence level: 100%)
120.79.229.151Cobalt Strike botnet C2 server (confidence level: 100%)
8.137.77.49Cobalt Strike botnet C2 server (confidence level: 100%)
49.235.188.214Cobalt Strike botnet C2 server (confidence level: 100%)
45.74.48.72Remcos botnet C2 server (confidence level: 100%)
185.185.69.14Remcos botnet C2 server (confidence level: 100%)
165.22.180.207Sliver botnet C2 server (confidence level: 100%)
199.68.217.91AsyncRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-10-17

Impact

For European organizations, the impact of this threat is currently limited due to the lack of specific exploit details or active campaigns. However, the involvement of payload delivery mechanisms implies a potential risk of malware infection if the IOCs are leveraged by threat actors. Organizations relying on OSINT for threat detection may benefit from integrating these IOCs into their monitoring systems to enhance situational awareness. The medium severity rating suggests a moderate risk to confidentiality, integrity, or availability if exploited, but the absence of known exploits and patches reduces immediate concern. The threat could potentially be used as part of broader cyber espionage or cybercrime campaigns targeting network infrastructure or endpoints, but no direct evidence supports this at present. European entities with high-value targets or critical infrastructure should maintain vigilance but are not currently at elevated risk based on this data alone.

Defensive guidance

Given the lack of specific exploit details or affected products, mitigation should focus on enhancing general detection and response capabilities. European organizations should: 1) Integrate the latest ThreatFox IOCs into their Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to improve detection of related network activity or payload delivery attempts. 2) Maintain up-to-date threat intelligence feeds and ensure analysts review OSINT updates regularly. 3) Conduct network traffic analysis to identify unusual or suspicious payload delivery patterns consistent with the IOCs. 4) Enforce strict network segmentation and least privilege principles to limit potential malware spread. 5) Educate staff on recognizing phishing or social engineering attempts that could serve as initial infection vectors. 6) Prepare incident response plans that include procedures for handling malware infections and payload delivery threats. These steps go beyond generic advice by emphasizing proactive integration of specific threat intelligence and operational readiness.

Community reviews

Loading reviews…