IndicatorPublished 4 Nov 2025Updated 5 Nov 2025

ThreatFox IOCs for 2025-11-04

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 277

momscare.ae.risallanursing.aeUnknown malware payload delivery domain (confidence level: 100%)
myminicabin.comUnknown malware payload delivery domain (confidence level: 100%)
thesmartboater.comUnknown malware payload delivery domain (confidence level: 100%)
theadventuresbook.comUnknown malware payload delivery domain (confidence level: 100%)
womensfitnessplans.comUnknown malware payload delivery domain (confidence level: 100%)
babyboomerlive.comUnknown malware payload delivery domain (confidence level: 100%)
stalbanspostboxes.comUnknown malware payload delivery domain (confidence level: 100%)
winstarplumbing.comUnknown malware payload delivery domain (confidence level: 100%)
aurorabuildings.comUnknown malware payload delivery domain (confidence level: 100%)
idanreclub15.comUnknown malware payload delivery domain (confidence level: 100%)

URLs 51

http://87.120.126.100/mames33.wavUnknown malware payload delivery URL (confidence level: 100%)
https://i-like-ele-phants-verification.live/iamchallenge/verification/userid7383526Unknown malware payload delivery URL (confidence level: 100%)
https://summerandsilver.co.uk/content/plugins/verification/cloudflare_challenge/not_a_robot/id6362572Unknown malware payload delivery URL (confidence level: 100%)
http://94.156.154.194/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 100%)
https://94.103.1.71/gateway/4xi2fes6.mqd9iRhadamanthys botnet C2 (confidence level: 100%)
https://gwqprwnu.vl/gateway/4xi2fes6.mqd9iRhadamanthys botnet C2 (confidence level: 100%)
https://elriosella.com/mcvyu.wavNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://94.103.1.38/gateway/4iqvfcnr.k8w66Rhadamanthys botnet C2 (confidence level: 100%)
https://zttfosmo.rm/gateway/4iqvfcnr.k8w66Rhadamanthys botnet C2 (confidence level: 100%)
http://95.164.53.235:5506/rs.vbsUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 239

179.61.132.175Mirai botnet C2 server (confidence level: 80%)
49.233.204.250Cobalt Strike botnet C2 server (confidence level: 100%)
38.12.31.254Cobalt Strike botnet C2 server (confidence level: 100%)
158.94.208.89Latrodectus botnet C2 server (confidence level: 100%)
158.94.208.81Latrodectus botnet C2 server (confidence level: 100%)
158.94.208.80Latrodectus botnet C2 server (confidence level: 100%)
205.234.144.107Remcos botnet C2 server (confidence level: 100%)
178.16.53.140Remcos botnet C2 server (confidence level: 100%)
88.125.229.221Sliver botnet C2 server (confidence level: 100%)
36.255.98.59SectopRAT botnet C2 server (confidence level: 100%)

Hashes 4

Unknown Stealer payload (confidence level: 100%)

fc0ab97197cc60c885aacd428d0692c5
25be0d9c91ae366cccd47b5dc10705b0
ae3ffebe3072bd558851bc748079e62c
83ad85a90cf242de2eda99e67dc5b026

Description

ThreatFox IOCs for 2025-11-04

Impact

For European organizations, the impact of this threat is primarily in the domain of detection and early warning rather than direct compromise. Since no specific exploits or vulnerabilities are identified, the risk lies in potential malware infections that could be detected using these IOCs. Organizations that rely on OSINT feeds and automated threat intelligence platforms can leverage this information to enhance their security posture. However, failure to incorporate such IOCs could result in delayed detection of malware payload delivery attempts, potentially leading to data breaches, service disruptions, or lateral movement within networks. The medium severity suggests a moderate risk, where the threat could facilitate initial access or reconnaissance stages of an attack chain but is unlikely to cause immediate critical damage without further exploitation. The absence of patches or direct exploits means that the threat is more about awareness and preparedness than urgent remediation. European sectors with high exposure to cyber threats, such as finance, critical infrastructure, and government, should consider this intelligence relevant for their ongoing threat hunting and monitoring activities.

Defensive guidance

European organizations should integrate the ThreatFox IOCs into their existing security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to improve detection capabilities. Regularly updating threat intelligence feeds and correlating these IOCs with internal logs can help identify early signs of malware payload delivery or suspicious network activity. Network segmentation and strict egress filtering can limit the impact of any detected malware communications. Security teams should conduct proactive threat hunting exercises using these IOCs to uncover latent infections or reconnaissance activities. Additionally, organizations should ensure that their incident response plans include procedures for handling malware infections indicated by these IOCs. Training and awareness programs should emphasize the importance of OSINT-based threat intelligence and its role in early detection. Finally, collaboration with national and European cybersecurity centers can enhance situational awareness and response coordination.

Community reviews

Loading reviews…