IndicatorPublished 18 Oct 2025Updated 19 Oct 2025

ThreatFox IOCs for 2025-10-18

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 185

06342.99y401874.ruClearFake payload delivery domain (confidence level: 100%)
740.08u073852.ruClearFake payload delivery domain (confidence level: 100%)
2215.08u073852.ruClearFake payload delivery domain (confidence level: 100%)
60012.08u073852.ruClearFake payload delivery domain (confidence level: 100%)
918274.08u073852.ruClearFake payload delivery domain (confidence level: 100%)
3007812.08u073852.ruClearFake payload delivery domain (confidence level: 100%)
05a9.08u073852.ruClearFake payload delivery domain (confidence level: 100%)
889.08u073852.ruClearFake payload delivery domain (confidence level: 100%)
431.11u812580.ruClearFake payload delivery domain (confidence level: 100%)
9023.11u812580.ruClearFake payload delivery domain (confidence level: 100%)

URLs 23

https://lh24h7tp-5500.euw.devtunnels.ms/checker/1.pdbDCRat payload delivery URL (confidence level: 100%)
https://xmg102.wxlmail.com/SpyNote payload delivery URL (confidence level: 50%)
https://ustr.nouz.cn/SpyNote payload delivery URL (confidence level: 50%)
https://sea0123.malaysiatiktok.top/SpyNote payload delivery URL (confidence level: 50%)
https://doudouni01.top/SpyNote payload delivery URL (confidence level: 50%)
https://doudouni12.top/SpyNote payload delivery URL (confidence level: 50%)
https://doudouni13.top/SpyNote payload delivery URL (confidence level: 50%)
https://doudouni15.top/SpyNote payload delivery URL (confidence level: 50%)
https://doudouni18.top/SpyNote payload delivery URL (confidence level: 50%)
http://106.52.154.100:8888/supershell/loginUnknown malware payload delivery URL (confidence level: 50%)

IP addresses 112

102.117.169.163Unknown malware botnet C2 server (confidence level: 100%)
149.88.74.72Quasar RAT botnet C2 server (confidence level: 100%)
185.72.199.97Quasar RAT botnet C2 server (confidence level: 100%)
196.251.86.107Havoc botnet C2 server (confidence level: 100%)
213.209.143.167Bashlite botnet C2 server (confidence level: 100%)
196.75.218.11Meterpreter botnet C2 server (confidence level: 100%)
193.161.193.99XWorm botnet C2 server (confidence level: 100%)
188.137.180.79Cobalt Strike botnet C2 server (confidence level: 100%)
114.67.98.107Cobalt Strike botnet C2 server (confidence level: 100%)
47.108.21.186Cobalt Strike botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-10-18

Impact

For European organizations, the impact of this threat is primarily in the domain of enhanced situational awareness and improved detection capabilities. Since no active exploitation or specific vulnerabilities are identified, the direct risk to confidentiality, integrity, or availability is low at this time. However, failure to incorporate these IOCs into security monitoring could result in missed detection of malware payload delivery attempts or network-based reconnaissance activities. Organizations heavily reliant on network security and threat intelligence, such as financial institutions, critical infrastructure, and government agencies, may benefit from early identification of related malicious activity. The medium severity rating indicates that while the threat is not immediately critical, it warrants attention to prevent potential escalation or exploitation in the future.

Defensive guidance

European organizations should integrate the provided IOCs into their existing Security Information and Event Management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection of related malware activities. Regularly updating threat intelligence feeds and correlating these IOCs with internal logs can improve early warning capabilities. Network segmentation and strict monitoring of outbound traffic can help contain potential payload delivery attempts. Conducting threat hunting exercises using these IOCs may uncover latent infections or reconnaissance activities. Additionally, organizations should maintain robust incident response plans that incorporate OSINT-derived intelligence to quickly analyze and respond to suspicious network activity. Since no patches are available, emphasis should be placed on detection and containment rather than remediation of a specific vulnerability.

Community reviews

Loading reviews…