IndicatorPublished 1 Nov 2025Updated 2 Nov 2025

ThreatFox IOCs for 2025-11-01

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 279

accomplish-suppose-val-ensure.trycloudflare.comKongTuke botnet C2 domain (confidence level: 75%)
stress-substance-mall-corrections.trycloudflare.comKongTuke botnet C2 domain (confidence level: 75%)
rider-february-thorough-decades.trycloudflare.comKongTuke botnet C2 domain (confidence level: 75%)
termination-str-north-cool.trycloudflare.comKongTuke botnet C2 domain (confidence level: 75%)
castle-fifth-print-metallic.trycloudflare.comKongTuke botnet C2 domain (confidence level: 75%)
librarian-alabama-iowa-vegetables.trycloudflare.comKongTuke botnet C2 domain (confidence level: 75%)
techwebi.netUnknown malware botnet C2 domain (confidence level: 100%)
register.toastmasters86.orgFAKEUPDATES botnet C2 domain (confidence level: 100%)
29.zo4n.ruClearFake payload delivery domain (confidence level: 100%)
tq8.i3-42s.ruClearFake payload delivery domain (confidence level: 100%)

URLs 23

http://190.2.145.187Unknown malware botnet C2 (confidence level: 100%)
http://190.2.150.186Unknown malware botnet C2 (confidence level: 100%)
http://185.185.49.77Unknown malware botnet C2 (confidence level: 100%)
http://190.2.150.101Unknown malware botnet C2 (confidence level: 100%)
http://185.185.49.73Unknown malware botnet C2 (confidence level: 100%)
http://185.180.223.155Unknown malware botnet C2 (confidence level: 100%)
http://190.2.145.188Unknown malware botnet C2 (confidence level: 100%)
http://190.2.143.54Unknown malware botnet C2 (confidence level: 100%)
https://genuslu.lat/apiLumma Stealer botnet C2 (confidence level: 100%)
http://167.160.191.178:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)

IP addresses 202

157.180.85.216KongTuke botnet C2 server (confidence level: 75%)
216.245.184.56KongTuke botnet C2 server (confidence level: 75%)
168.119.155.85KongTuke botnet C2 server (confidence level: 75%)
111.229.187.190Cobalt Strike botnet C2 server (confidence level: 100%)
157.66.81.166AsyncRAT botnet C2 server (confidence level: 100%)
158.69.199.68Unknown malware botnet C2 server (confidence level: 100%)
83.136.250.244MimiKatz botnet C2 server (confidence level: 100%)
111.231.11.61Cobalt Strike botnet C2 server (confidence level: 100%)
47.76.144.218Cobalt Strike botnet C2 server (confidence level: 100%)
193.108.113.14Havoc botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-11-01

Impact

For European organizations, the impact of this threat is indirect. Since the information pertains to OSINT and network activity related to malware payload delivery without specific exploit details, the primary value lies in enhancing threat detection and response capabilities. Organizations that integrate ThreatFox IOCs into their security monitoring tools can improve their ability to detect malicious network activity and payloads early. However, the lack of known exploits or affected versions means there is no immediate risk of compromise from this specific update alone. The medium severity suggests a moderate level of concern, emphasizing the importance of maintaining updated threat intelligence feeds. Failure to incorporate such intelligence could result in delayed detection of malware campaigns that use these IOCs. Overall, the threat does not represent a direct attack vector but rather an intelligence resource that, if ignored, could reduce the effectiveness of defensive measures.

Defensive guidance

1. Integrate ThreatFox IOCs into existing Security Information and Event Management (SIEM) and intrusion detection systems to enhance detection of related network activity and payload delivery attempts. 2. Regularly update threat intelligence feeds to ensure the latest IOCs are available for correlation and analysis. 3. Conduct network traffic analysis focusing on anomalies that match the behavioral patterns described in the OSINT and payload delivery categories. 4. Train SOC analysts to interpret and utilize OSINT-based IOCs effectively, emphasizing correlation with other threat data sources. 5. Implement network segmentation and strict egress filtering to limit the impact of potential payload delivery. 6. Maintain robust endpoint detection and response (EDR) solutions capable of identifying suspicious payload execution. 7. Engage in information sharing with European cybersecurity communities to contextualize and validate the relevance of these IOCs. 8. Since no patches are available, focus on detection and response rather than remediation of a specific vulnerability.

Community reviews

Loading reviews…