IndicatorPublished 7 Nov 2025Updated 8 Nov 2025

ThreatFox IOCs for 2025-11-07

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 530

saeam.comKongTuke payload delivery domain (confidence level: 100%)
images.nestledinniagara.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
q2k.sunny-harbor.ruClearFake payload delivery domain (confidence level: 100%)
x1p.sunny-harbor.ruClearFake payload delivery domain (confidence level: 100%)
h9m.sunny-harbor.ruClearFake payload delivery domain (confidence level: 100%)
rz4.sunny-harbor.ruClearFake payload delivery domain (confidence level: 100%)
k2v.whisperlake.ruClearFake payload delivery domain (confidence level: 100%)
t3q.whisperlake.ruClearFake payload delivery domain (confidence level: 100%)
yxm4.whisperlake.ruClearFake payload delivery domain (confidence level: 100%)
c4n.whisperlake.ruClearFake payload delivery domain (confidence level: 100%)

URLs 309

https://saeam.com/6w9h.jsKongTuke payload delivery URL (confidence level: 100%)
https://saeam.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
http://88.214.50.76Stealc botnet C2 (confidence level: 100%)
http://185.24.55.37:8080/Chaos botnet C2 (confidence level: 50%)
http://www.117a.shop/ned5/Formbook botnet C2 (confidence level: 50%)
http://www.1475p.cc/gb52/Formbook botnet C2 (confidence level: 50%)
http://www.21581.com/gb52/Formbook botnet C2 (confidence level: 50%)
http://www.371q.top/ned5/Formbook botnet C2 (confidence level: 50%)
http://www.483650885622.shop/gb52/Formbook botnet C2 (confidence level: 50%)
http://www.58e0as.top/gb52/Formbook botnet C2 (confidence level: 50%)

IP addresses 344

178.16.54.33Mozi payload delivery server (confidence level: 100%)
45.156.87.15Mirai botnet C2 server (confidence level: 100%)
88.214.50.133Cobalt Strike botnet C2 server (confidence level: 100%)
16.171.54.42Sliver botnet C2 server (confidence level: 100%)
103.226.153.164ValleyRAT botnet C2 server (confidence level: 100%)
154.86.157.18FatalRat botnet C2 server (confidence level: 100%)
103.83.87.241PureLogs Stealer botnet C2 server (confidence level: 100%)
206.119.174.5ValleyRAT botnet C2 server (confidence level: 100%)
1.94.62.205Cobalt Strike botnet C2 server (confidence level: 75%)
124.223.104.136Cobalt Strike botnet C2 server (confidence level: 75%)

Hashes 207

979af52c57a4bc22da1e98f5ce0681368f672fb3MASS Logger payload (confidence level: 95%)
a57f0775c8de97d1592ffb63b65488c5f2470bc274f5fcfadbabf734f51f4c4aMASS Logger payload (confidence level: 95%)
3b4a6119440136a1b3f286e815189ae8MASS Logger payload (confidence level: 95%)
9b2f1de35d2d2bf3050696b63472087b7d338395ValleyRAT payload (confidence level: 95%)
499ed1dfdb2b51f3e1bc8859dbd64c3e15b6f61d1a8fa5b644968514bf7e064aValleyRAT payload (confidence level: 95%)
64323da0889df17fbd61728dadaedfb1ValleyRAT payload (confidence level: 95%)
4ed86a2bebf4e7e22ab081ed83d15af5ac4fb702StrelaStealer payload (confidence level: 95%)
cf3810352dd12c9332bb34cfcbb6a586f6736f663cdd9bdcdc090e193eb11139StrelaStealer payload (confidence level: 95%)
f105b3ebeaccb1c5a2a297229e1b6146StrelaStealer payload (confidence level: 95%)
a8e7bc429b76f4a095a9ae0f7ffb548357018f94FatalRat payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-11-07

Impact

For European organizations, the impact of this threat is currently moderate due to the absence of active exploitation or known vulnerabilities. However, the involvement of payload delivery and network activity categories indicates a risk of malware infiltration via network vectors, which could compromise confidentiality, integrity, or availability if successful. Organizations relying heavily on OSINT tools or those with complex network infrastructures may face increased exposure. Potential impacts include unauthorized access, data exfiltration, or disruption of services if the malware payloads are delivered and executed. The lack of patches or specific mitigation details means organizations must rely on proactive detection and response capabilities. The medium severity rating suggests that while immediate risk is not critical, ongoing monitoring and preparedness are essential to prevent escalation. European entities in sectors such as finance, government, and critical infrastructure should be particularly attentive given their strategic importance and attractiveness to threat actors.

Defensive guidance

Given the limited technical details and absence of patches, mitigation should focus on enhancing network security posture and threat intelligence integration. Specific recommendations include: 1) Implement advanced network monitoring and anomaly detection to identify unusual payload delivery or network activity patterns. 2) Integrate ThreatFox and other OSINT feeds into Security Information and Event Management (SIEM) systems to correlate emerging IOCs with internal logs. 3) Conduct regular threat hunting exercises focused on network-based malware delivery vectors. 4) Enforce strict network segmentation and least privilege access to limit malware propagation. 5) Maintain up-to-date endpoint detection and response (EDR) solutions capable of detecting suspicious payload execution. 6) Train security teams to recognize and respond to emerging OSINT-based threat intelligence. 7) Establish incident response plans that include scenarios involving network-delivered malware. These measures go beyond generic advice by emphasizing proactive intelligence-driven detection and response tailored to network-based payload threats.

Community reviews

Loading reviews…