IndicatorPublished 6 Nov 2025Updated 7 Nov 2025

ThreatFox IOCs for 2025-11-06

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 247

imf1.comKongTuke payload delivery domain (confidence level: 100%)
secure.kasindramaharaj.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
smilesmash.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
ft.imugandas.comMirai botnet C2 domain (confidence level: 80%)
n1k.7nf214.ruClearFake payload delivery domain (confidence level: 100%)
ab.lunarlicht.ruClearFake payload delivery domain (confidence level: 100%)
t1w.cometwald.ruClearFake payload delivery domain (confidence level: 100%)
m7x.lunarlicht.ruClearFake payload delivery domain (confidence level: 100%)
3qd.7nf214.ruClearFake payload delivery domain (confidence level: 100%)
q2k.lunarlicht.ruClearFake payload delivery domain (confidence level: 100%)

URLs 22

https://imf1.com/9h0y.jsKongTuke payload delivery URL (confidence level: 100%)
https://imf1.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
http://72.5.43.147:7777/frt44KongTuke payload delivery URL (confidence level: 100%)
http://72.5.43.147:7777/2ndKongTuke payload delivery URL (confidence level: 100%)
https://smilesmash.com/xss/buf.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://smilesmash.com/xss/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://bb.tweethost.com/Vidar botnet C2 (confidence level: 100%)
https://bb.fabiankorte.net/Vidar botnet C2 (confidence level: 100%)
https://bb.ethicaltechinstitute.org.uk/Vidar botnet C2 (confidence level: 100%)
https://ka.fundsreclaimllc.com/Vidar botnet C2 (confidence level: 100%)

IP addresses 159

18.230.118.147XMRIG botnet C2 server (confidence level: 100%)
82.147.85.212Mirai botnet C2 server (confidence level: 80%)
196.251.114.166Remcos botnet C2 server (confidence level: 100%)
212.71.246.109Sliver botnet C2 server (confidence level: 100%)
160.176.88.16NetSupportManager RAT botnet C2 server (confidence level: 100%)
18.217.155.157NetSupportManager RAT botnet C2 server (confidence level: 100%)
89.35.130.116Bashlite botnet C2 server (confidence level: 100%)
51.155.228.1Empire Downloader botnet C2 server (confidence level: 100%)
91.92.243.7Remcos botnet C2 server (confidence level: 100%)
1.95.207.237Cobalt Strike botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-11-06

Impact

For European organizations, the impact of this threat is primarily related to the potential for malware infection through network-based delivery mechanisms. While no active exploits are reported, the presence of IOCs enables attackers or automated tools to attempt payload delivery, which could lead to data compromise, disruption of services, or unauthorized access if successful. Organizations relying heavily on networked infrastructure, especially those in critical sectors such as finance, energy, and telecommunications, may face increased risk due to the potential for lateral movement or data exfiltration. The medium severity suggests that while the threat is not immediately critical, it warrants attention to prevent escalation. The lack of patches means that mitigation relies on detection and response capabilities rather than vulnerability remediation. Additionally, the OSINT nature of the threat indicates that attackers may leverage publicly available information to tailor attacks, increasing the sophistication and potential impact on targeted entities. Failure to detect or respond to these IOCs could result in operational disruptions or compromise of sensitive information.

Defensive guidance

European organizations should implement enhanced network monitoring to detect suspicious payload delivery and network activity consistent with the provided IOCs. Integration of ThreatFox and other OSINT feeds into Security Information and Event Management (SIEM) systems can improve detection capabilities. Regularly updating and tuning intrusion detection/prevention systems (IDS/IPS) to recognize emerging malware signatures is critical. Conducting threat hunting exercises focused on network traffic anomalies and payload delivery patterns can proactively identify potential infections. Organizations should also ensure robust segmentation of critical network assets to limit lateral movement in case of compromise. Employee awareness training on recognizing phishing or social engineering attempts that may serve as initial infection vectors is recommended, even though user interaction is not explicitly required here. Incident response plans should be reviewed and tested to ensure rapid containment and remediation of detected malware activity. Finally, collaboration with national cybersecurity centers and sharing of threat intelligence within European cybersecurity communities can enhance collective defense.

Community reviews

Loading reviews…