IndicatorPublished 5 Nov 2025Updated 6 Nov 2025

ThreatFox IOCs for 2025-11-05

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 286

excellencebpo.comUnknown malware payload delivery domain (confidence level: 100%)
emaragogi.com.brUnknown malware payload delivery domain (confidence level: 100%)
s3.mirgaza.ruUnknown malware payload delivery domain (confidence level: 100%)
vakarpishkov.magnaart.ru.fbweb.ruUnknown malware payload delivery domain (confidence level: 100%)
connect.zave.lolUnknown RAT botnet C2 domain (confidence level: 100%)
controllerjs.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
cpajoliette.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
kislonij.proNetSupportManager RAT payload delivery domain (confidence level: 100%)
acrobatupdatesystem.comUnknown malware payload delivery domain (confidence level: 100%)
pdfacrobatupdate.comUnknown malware payload delivery domain (confidence level: 100%)

URLs 29

http://178.16.54.109/molopPhorpiex payload delivery URL (confidence level: 100%)
http://176.46.158.64/plopPhorpiex payload delivery URL (confidence level: 100%)
http://176.46.158.64/1Phorpiex payload delivery URL (confidence level: 100%)
http://176.46.158.64/2Phorpiex payload delivery URL (confidence level: 100%)
https://controllerjs.com/xss/buf.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://controllerjs.com/xss/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://cpajoliette.com/d.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://kislonij.pro/xss/buf.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://kislonij.pro/xss/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://securefiledepot.com/scan-doc794559.pdf.exeUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 202

109.199.113.204Unknown RAT botnet C2 server (confidence level: 100%)
95.181.213.48Unknown RAT botnet C2 server (confidence level: 100%)
109.199.113.250Unknown RAT botnet C2 server (confidence level: 100%)
216.126.86.17Loki Password Stealer (PWS) botnet C2 server (confidence level: 75%)
115.190.62.191AdaptixC2 botnet C2 server (confidence level: 100%)
115.190.62.191AdaptixC2 botnet C2 server (confidence level: 100%)
213.142.159.116Quasar RAT botnet C2 server (confidence level: 75%)
172.245.27.131XWorm botnet C2 server (confidence level: 75%)
172.111.169.8Remcos botnet C2 server (confidence level: 100%)
125.237.198.243AsyncRAT botnet C2 server (confidence level: 100%)

Hashes 144

8a07a33bce7f381e17b8bad17454d5409128fdf3Formbook payload (confidence level: 95%)
5a741df3e4a61b8632f62109a65afc0f297f4ed03cd7e208ffd2ea5e2badf318Formbook payload (confidence level: 95%)
7bb83d32203f1604785ddc909bcce6daFormbook payload (confidence level: 95%)
d1e3a580d2411d1fe1e68d72277d5d5050c79c71Formbook payload (confidence level: 95%)
0fd7eb57f5f9d817dd497c1ce3be0791f5e798077f8dc2c3a4e2b2b0b0bdc2c6Formbook payload (confidence level: 95%)
d7ce6c361cf0a395853a7f06df22c71fFormbook payload (confidence level: 95%)
1eabc2abf54e6905480d7abd9c5b7314259293fbFormbook payload (confidence level: 95%)
13a5c1a535c161fd2724423dad1dfa6885c705713569d4ed4f2ebf900df25ed7Formbook payload (confidence level: 95%)
4be1ae298b7174f13c9ef8dce3b7d800Formbook payload (confidence level: 95%)
987b7b137633df23202b259bd702ba8fea00d297Formbook payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-11-05

Impact

Due to the lack of specific affected systems, known exploits, or detailed indicators, the direct impact on European organizations is currently limited and largely theoretical. The medium severity rating suggests a moderate risk level, potentially involving malware payload delivery via network activity that could lead to data compromise or disruption if exploited. However, without concrete details, the scope and scale of impact remain uncertain. European organizations relying heavily on OSINT tools or vulnerable to generic payload delivery mechanisms should maintain vigilance. The absence of patches or exploit data indicates no immediate widespread threat, but the potential for future exploitation exists if further details emerge. The impact could range from minor network disruptions to more serious data breaches if the threat evolves or is combined with other vulnerabilities. Organizations should consider this an early warning to enhance monitoring and incident response readiness rather than an immediate crisis.

Defensive guidance

Given the generic nature of this threat intelligence update, mitigation should focus on enhancing network monitoring and OSINT-related security practices. Organizations should: 1) Implement and maintain robust network intrusion detection and prevention systems (IDS/IPS) to identify suspicious payload delivery attempts. 2) Continuously update and tune threat intelligence feeds, including ThreatFox, to incorporate any emerging indicators. 3) Conduct regular security awareness training emphasizing phishing and social engineering, common vectors for payload delivery. 4) Employ strict network segmentation and access controls to limit lateral movement if a payload is delivered. 5) Maintain comprehensive logging and monitoring to detect anomalous network activity promptly. 6) Prepare incident response plans that include procedures for analyzing and responding to OSINT-derived threat intelligence. 7) Collaborate with information sharing groups to receive timely updates on evolving threats. These measures go beyond generic advice by focusing on proactive detection and response tailored to the nature of OSINT and network-based payload threats.

Community reviews

Loading reviews…