IndicatorPublished 8 Nov 2025Updated 9 Nov 2025

ThreatFox IOCs for 2025-11-08

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 733

files.parsonspaving.caFAKEUPDATES botnet C2 domain (confidence level: 100%)
capckutapk.netUnknown malware botnet C2 domain (confidence level: 75%)
solomand.proNetSupportManager RAT payload delivery domain (confidence level: 100%)
chrmeupdate.comUnknown malware payload delivery domain (confidence level: 100%)
pixelnoased.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
journeywekk.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
stein.badgerfels.ruClearFake payload delivery domain (confidence level: 100%)
otter.otterweg.ruClearFake payload delivery domain (confidence level: 100%)
weg.otterweg.ruClearFake payload delivery domain (confidence level: 100%)
ufer.otterweg.ruClearFake payload delivery domain (confidence level: 100%)

URLs 144

https://solomand.pro/xss/buf.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://solomand.pro/xss/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://pixelnoased.com/xss/buf.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://pixelnoased.com/xss/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://journeywekk.com/xss/buf.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://journeywekk.com/xss/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://446195cm.nyash.es/externaleternal_httpapimultiwpdlepublic.phpDCRat botnet C2 (confidence level: 100%)
http://anfesq.comAmadey botnet C2 (confidence level: 100%)
http://maskofmistery.icu/index.phpAzorult botnet C2 (confidence level: 100%)
https://123123123.asia/SpyNote botnet C2 (confidence level: 50%)

IP addresses 124

5.101.82.49Remcos botnet C2 server (confidence level: 100%)
54.152.7.169Havoc botnet C2 server (confidence level: 100%)
15.161.127.193NetSupportManager RAT botnet C2 server (confidence level: 100%)
15.206.91.105NetSupportManager RAT botnet C2 server (confidence level: 100%)
45.153.34.5RedLine Stealer botnet C2 server (confidence level: 100%)
123.53.36.194Cobalt Strike botnet C2 server (confidence level: 75%)
113.45.205.53Cobalt Strike botnet C2 server (confidence level: 100%)
143.92.32.177Remcos botnet C2 server (confidence level: 100%)
20.196.129.27Quasar RAT botnet C2 server (confidence level: 100%)
47.243.131.179Venom RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-11-08

Impact

For European organizations, the impact of this threat is currently moderate due to the lack of specific exploitation details or active attacks. However, the presence of malware-related network activity and payload delivery mechanisms implies potential risks to confidentiality, integrity, and availability if the threat evolves or is leveraged in targeted campaigns. Organizations with extensive network infrastructure and reliance on timely threat intelligence may face increased exposure if these IOCs correspond to emerging malware strains. The absence of patches or known exploits suggests that the threat is not exploiting a known vulnerability but may rely on social engineering or other delivery methods. If left unmonitored, this could lead to undetected malware infections, data breaches, or service disruptions. The medium severity rating indicates that while immediate damage is unlikely, vigilance is necessary to prevent escalation. European entities in sectors such as finance, critical infrastructure, and government may be particularly sensitive to such threats due to their strategic importance and attractiveness to threat actors. The evolving nature of the threat underscores the need for proactive detection and response capabilities to mitigate potential future impacts.

Defensive guidance

1. Integrate the ThreatFox IOCs into existing Security Information and Event Management (SIEM) and intrusion detection systems to enhance detection of related network activity and payload delivery attempts. 2. Conduct regular network traffic analysis focusing on anomalous behaviors that may indicate malware delivery or command and control communications. 3. Enhance endpoint detection and response (EDR) capabilities to identify and contain malware infections early. 4. Maintain up-to-date threat intelligence feeds and ensure security teams are trained to interpret and act on OSINT-derived indicators. 5. Implement strict network segmentation and access controls to limit malware propagation in case of infection. 6. Conduct phishing awareness and social engineering training to reduce the risk of initial payload delivery via user interaction. 7. Establish incident response playbooks tailored to malware detection and containment scenarios. 8. Regularly review and update firewall and proxy rules to block known malicious domains or IP addresses associated with the IOCs once identified. 9. Collaborate with national and European cybersecurity centers to share intelligence and receive timely alerts on emerging threats. 10. Monitor for updates from ThreatFox and other intelligence providers for new indicators or changes in threat status.

Community reviews

Loading reviews…