IndicatorPublished 2 Nov 2025Updated 3 Nov 2025

ThreatFox IOCs for 2025-11-02

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 276

login.relatec.it.comUnknown malware botnet C2 domain (confidence level: 100%)
ccpwnews.comHavoc botnet C2 domain (confidence level: 100%)
w1.7n28r.ruClearFake payload delivery domain (confidence level: 100%)
r1n8k.mjg1.onlineClearFake payload delivery domain (confidence level: 100%)
s.zms-u.ruClearFake payload delivery domain (confidence level: 100%)
p3zy.y8-8.onlineClearFake payload delivery domain (confidence level: 100%)
h1.zms-u.ruClearFake payload delivery domain (confidence level: 100%)
v3.zms-u.ruClearFake payload delivery domain (confidence level: 100%)
p.595-1.ruClearFake payload delivery domain (confidence level: 100%)
j8q2.mjg1.onlineClearFake payload delivery domain (confidence level: 100%)

URLs 5

https://penstjn.lat/apiLumma Stealer botnet C2 (confidence level: 75%)
http://mi.huffproofs.comAmadey botnet C2 (confidence level: 100%)
http://64.188.98.71/api/ytasodasodasytisytasodmsogqsotysnjusodisSmartLoader botnet C2 (confidence level: 100%)
http://939870cm.nyash.es/packetgeoprocessuploads.phpDCRat botnet C2 (confidence level: 100%)
http://aaaaakkkkkii.life/providervideosecuregeneratoruniversal.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 81

107.149.142.35Unknown malware botnet C2 server (confidence level: 100%)
196.251.88.188AsyncRAT botnet C2 server (confidence level: 100%)
197.5.192.204Unknown malware botnet C2 server (confidence level: 100%)
168.231.116.237Hook botnet C2 server (confidence level: 100%)
116.49.85.177Unknown malware botnet C2 server (confidence level: 100%)
172.245.253.163Unknown malware botnet C2 server (confidence level: 100%)
45.77.246.213Unknown malware botnet C2 server (confidence level: 100%)
196.251.116.2Remcos botnet C2 server (confidence level: 100%)
93.113.98.22Unknown RAT botnet C2 server (confidence level: 100%)
181.162.147.189Quasar RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-11-02

Impact

For European organizations, the impact of this threat is currently limited due to the absence of known exploits or specific affected systems. However, the presence of malware-related IOCs focusing on network activity and payload delivery suggests potential risks if such malware campaigns were to materialize or evolve. Organizations relying heavily on OSINT tools or those with complex network infrastructures could face risks related to malware infiltration or lateral movement if these IOCs correspond to emerging threats. The medium severity rating implies that while immediate disruption or data compromise is unlikely, there is a moderate risk that could escalate if the threat actors develop active exploits. The lack of patches or mitigation details means organizations must rely on proactive detection and response capabilities. In the European context, sectors such as finance, critical infrastructure, and government agencies, which are frequent targets of malware campaigns, should maintain heightened awareness and integrate these IOCs into their threat detection frameworks to preempt potential attacks.

Defensive guidance

Given the nature of this threat as an OSINT-based malware IOC update without specific exploits or patches, mitigation should focus on enhancing detection and response capabilities. Organizations should integrate the ThreatFox IOCs into their security information and event management (SIEM) systems and endpoint detection and response (EDR) tools to improve visibility of potential malicious network activity and payload delivery attempts. Network segmentation and strict access controls can limit the impact of any malware that attempts lateral movement. Regular threat intelligence sharing and collaboration with industry peers and national cybersecurity centers will help contextualize these IOCs and identify emerging threats early. Additionally, organizations should conduct regular network traffic analysis to detect anomalies and employ behavioral analytics to identify suspicious payload delivery patterns. Employee training on recognizing phishing and social engineering attempts remains critical to prevent initial infection vectors. Finally, maintaining up-to-date backups and incident response plans ensures readiness in case of malware incidents.

Community reviews

Loading reviews…