IndicatorPublished 25 Oct 2025Updated 26 Oct 2025

ThreatFox IOCs for 2025-10-25

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 281

cpanel.sayyesmovement.caFAKEUPDATES botnet C2 domain (confidence level: 100%)
ik.yjor.ruClearFake payload delivery domain (confidence level: 100%)
rz.zi-qa.ruClearFake payload delivery domain (confidence level: 100%)
rz3.1e2u2a0.ruClearFake payload delivery domain (confidence level: 100%)
w5en.cdn-6-38.ruClearFake payload delivery domain (confidence level: 100%)
v8.ziqa.ruClearFake payload delivery domain (confidence level: 100%)
d9.4a7vci9.ruClearFake payload delivery domain (confidence level: 100%)
aa.b2-ra.ruClearFake payload delivery domain (confidence level: 100%)
c4hz.cdn-6-38.ruClearFake payload delivery domain (confidence level: 100%)
mi.g-lim.ruClearFake payload delivery domain (confidence level: 100%)

URLs 33

http://154.36.184.35/Hook botnet C2 (confidence level: 50%)
https://reddesignandprint.co.uk/huc/?id=isaqt4rg5oquuggmXWorm payload delivery URL (confidence level: 50%)
https://www.browse-health-insurance-plans.unitedhealthcare-group.uhc-com.vision-solution.top/?id=isaqt4rg5oquuggmXWorm payload delivery URL (confidence level: 50%)
https://5d8fd57c-62b0-48f1-b595-796cb6b6e7f4.server4.nisdably.com/Glupteba botnet C2 (confidence level: 50%)
https://ww25.5d8fd57c-62b0-48f1-b595-796cb6b6e7f4.server2.ninhaine.com/Glupteba botnet C2 (confidence level: 50%)
https://pastebin.com/raw/qphtbsruAsyncRAT botnet C2 (confidence level: 50%)
http://doupfate.ml/panel/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 50%)
http://196.251.81.93/hmfd8ejds/login.phpAmadey botnet C2 (confidence level: 100%)
http://mail.logrecovery.com/hmfd8ejds/login.phpAmadey botnet C2 (confidence level: 100%)
http://www.logrecovery.com/hmfd8ejds/login.phpAmadey botnet C2 (confidence level: 100%)

IP addresses 120

45.94.31.42AsyncRAT botnet C2 server (confidence level: 100%)
220.121.11.221Unknown malware botnet C2 server (confidence level: 100%)
145.40.252.206Unknown malware botnet C2 server (confidence level: 100%)
221.163.215.226Unknown malware botnet C2 server (confidence level: 100%)
138.75.120.161Unknown malware botnet C2 server (confidence level: 100%)
152.42.197.32MooBot botnet C2 server (confidence level: 100%)
116.62.151.244Unknown malware botnet C2 server (confidence level: 100%)
44.217.119.131Unknown malware botnet C2 server (confidence level: 100%)
159.203.70.73Unknown malware botnet C2 server (confidence level: 100%)
178.254.12.89Unknown malware botnet C2 server (confidence level: 100%)

Hashes 44

9ffc66cfdbe4780957925370962a69757cb000b30e7dfa5788f160670364a326Unknown Stealer payload (confidence level: 100%)
3930988ec97fe425cf4441f22dc4dca0aa086b3c7100ee2f67e13fe80b804151Unknown Stealer payload (confidence level: 100%)
6bffe01c34b9ec6e91e6392b305ae7398918f7f996ae9858ea6c6d9b4499c6f0Unknown Stealer payload (confidence level: 100%)
9ffc1446b20f86295bd48ea59037bc48a2258884a7ae9df27cb21ec49671bca5Unknown malware payload (confidence level: 50%)
805f6c57b3ae3337c585c473536f4e2a6e876bbe786f04cc61fb14cba1074ee3Unknown malware payload (confidence level: 50%)
654a646061bebc74ef1f6d293b361c56f6606b97c10d868c49be32644bd27826Unknown malware payload (confidence level: 50%)
9cc4bcedcd9de532ff0d785ff0b37e8b55791d823f638f0edc39f836d7ff4c91Unknown malware payload (confidence level: 50%)
b54311c6ccdd664babdc1c0a009d3432d4da71fbef4b72f4380e10e90409fe3dUnknown malware payload (confidence level: 50%)
c232a955b38134091bef955bb14f428113cd93ad5e217e675a286a4356378c05Unknown malware payload (confidence level: 50%)
7301372b7078f8c757d024af36816c34d1808d4413b26664b4f06dd7faacd887Unknown malware payload (confidence level: 50%)

Description

ThreatFox IOCs for 2025-10-25

Impact

The impact of this IOC update on European organizations is indirect and primarily related to enhancing threat detection and situational awareness. Since no active exploits or vulnerabilities are detailed, there is no immediate risk of compromise, data loss, or service disruption. However, organizations that integrate ThreatFox IOCs into their security monitoring tools can improve their ability to detect payload delivery attempts and suspicious network activity associated with malware campaigns. This can reduce dwell time and improve incident response effectiveness. The medium severity rating reflects the potential value of these IOCs in identifying emerging threats but also the absence of direct exploitation. European sectors with high-value targets, such as finance, critical infrastructure, and government, may benefit from incorporating these IOCs to preemptively detect adversary activity. The lack of patch availability means organizations must rely on detection and response rather than vulnerability remediation. Overall, the impact is positive in terms of threat intelligence enrichment but does not represent an immediate operational threat.

Defensive guidance

To effectively leverage this IOC update, European organizations should integrate the provided ThreatFox IOCs into their existing security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools. Regularly updating threat intelligence feeds and correlating these IOCs with internal logs can enhance early detection of payload delivery attempts and suspicious network activity. Organizations should conduct threat hunting exercises using these IOCs to identify potential compromises proactively. Since no patches are available, emphasis should be placed on network segmentation, strict egress filtering, and anomaly detection to limit the impact of any detected payload delivery. Security teams should also share relevant findings with national and European cybersecurity information sharing organizations such as ENISA to improve collective defense. Training and awareness programs should highlight the importance of OSINT-based threat intelligence in detecting emerging threats. Finally, organizations should maintain robust incident response plans to quickly contain and remediate any detected malicious activity.

Summary

The provided data describes a ThreatFox IOC update dated October 25, 2025, categorized under malware with emphasis on OSINT, payload delivery, and network activity. ThreatFox is a platform that aggregates and shares Indicators of Compromise to assist cybersecurity professionals in identifying and mitigating threats. This entry does not specify particular malware families, affected software versions, or detailed technical indicators such as hashes, IP addresses, or domains. The threat level is rated as medium with a threatLevel score of 2, analysis score of 1, and distribution score of 3, indicating moderate concern and distribution but limited analysis depth. No known exploits are currently active in the wild, and no patches or mitigations are linked, suggesting this is primarily an intelligence update rather than a new vulnerability or active attack vector. The tags and categories indicate the focus is on OSINT-driven detection of payload delivery mechanisms and network activity patterns. The absence of CWEs or specific vulnerabilities further supports that this is an intelligence feed entry rather than a direct security flaw. The UUID and timestamps provide traceability within the ThreatFox system but do not add technical exploit details. Overall, this entry serves as a resource to improve detection and response capabilities rather than signaling an immediate threat requiring urgent remediation.

Community reviews

Loading reviews…