IndicatorPublished 24 Oct 2025Updated 25 Oct 2025

ThreatFox IOCs for 2025-10-24

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 216

investor.veranofund.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
estate.verano.lifeFAKEUPDATES botnet C2 domain (confidence level: 100%)
cpanel.paquetesparaorlando.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
configure.visionsflorida.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
demo.halfmoonboulder.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
la-supreme.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
coorpfree9.duckdns.orgAsyncRAT botnet C2 domain (confidence level: 100%)
elumadns.eluma101.comNanocore RAT botnet C2 domain (confidence level: 100%)
elumadns.hopto.orgNanocore RAT botnet C2 domain (confidence level: 100%)
stg.server24x.comVidar botnet C2 domain (confidence level: 100%)

URLs 23

http://137.184.112.170/perlUnknown malware payload delivery URL (confidence level: 75%)
https://stg.server24x.com/Vidar botnet C2 (confidence level: 100%)
https://stg.mistonecorp.net/Vidar botnet C2 (confidence level: 100%)
https://yyj567.lllkoov.top/SpyNote botnet C2 (confidence level: 50%)
https://beeing.top/SpyNote botnet C2 (confidence level: 50%)
https://limintr.ejoy-tech.top/SpyNote botnet C2 (confidence level: 50%)
https://mycago.top/SpyNote botnet C2 (confidence level: 50%)
https://tjs.easy-dotnet.com/SpyNote botnet C2 (confidence level: 50%)
https://minibox.dennyding.vip/SpyNote botnet C2 (confidence level: 50%)
https://66.129.66.16/galilery/index.phpAmadey botnet C2 (confidence level: 50%)

IP addresses 124

195.96.129.161Mirai botnet C2 server (confidence level: 100%)
172.67.146.22Nanocore RAT botnet C2 server (confidence level: 75%)
43.201.115.211Sliver botnet C2 server (confidence level: 90%)
159.203.131.49Unknown malware botnet C2 server (confidence level: 100%)
57.128.16.51Unknown malware botnet C2 server (confidence level: 100%)
34.244.112.168Unknown malware botnet C2 server (confidence level: 100%)
65.0.231.50Unknown malware botnet C2 server (confidence level: 100%)
51.77.148.193Unknown malware botnet C2 server (confidence level: 100%)
91.92.240.56Latrodectus botnet C2 server (confidence level: 100%)
18.158.218.208Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-10-24

Impact

For European organizations, the impact of this threat entry is primarily informational. It provides threat intelligence that can improve detection and response capabilities but does not represent an active exploit or vulnerability that could directly compromise systems. Organizations that integrate such OSINT feeds into their security monitoring can enhance their ability to identify malicious network activity and payload delivery attempts. However, without specific exploit details or targeted attack campaigns, the immediate risk to confidentiality, integrity, or availability is low. The main impact is on security operations efficiency and threat hunting effectiveness. Failure to incorporate such intelligence may result in slower detection of emerging threats, but no direct damage or breach is implied by this data alone. The medium severity rating suggests a moderate level of importance for maintaining updated threat intelligence but does not indicate urgent remediation actions.

Defensive guidance

European organizations should focus on integrating the ThreatFox MISP feed and similar OSINT sources into their Security Information and Event Management (SIEM) systems and threat intelligence platforms to enhance detection capabilities. Regularly updating and tuning detection rules based on these IOCs can improve the identification of suspicious network activity and payload delivery attempts. Security teams should conduct periodic threat hunting exercises using the provided intelligence to proactively identify potential compromises. Additionally, organizations should maintain robust network segmentation, endpoint protection, and incident response plans to mitigate the impact of any detected malicious activity. Collaboration with national and European cybersecurity centers can facilitate sharing and contextualizing threat intelligence. Since no patches or direct fixes are available, emphasis should be on detection, monitoring, and response rather than remediation of a specific vulnerability. Training security analysts to interpret and operationalize OSINT feeds will maximize the value of this intelligence.

Community reviews

Loading reviews…