IndicatorPublished 10 Nov 2025Updated 11 Nov 2025

ThreatFox IOCs for 2025-11-10

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 473

casuapw.coursesLumma Stealer botnet C2 domain (confidence level: 75%)
diapsxi.coursesLumma Stealer botnet C2 domain (confidence level: 75%)
concoct.coursesLumma Stealer botnet C2 domain (confidence level: 75%)
fourtaa.coursesLumma Stealer botnet C2 domain (confidence level: 75%)
reddedi.coursesLumma Stealer botnet C2 domain (confidence level: 75%)
pastrzc.coursesLumma Stealer botnet C2 domain (confidence level: 75%)
pollaug.coursesLumma Stealer botnet C2 domain (confidence level: 75%)
parensm.coursesLumma Stealer botnet C2 domain (confidence level: 75%)
pursecm.coursesLumma Stealer botnet C2 domain (confidence level: 75%)
plateom.coursesLumma Stealer botnet C2 domain (confidence level: 75%)

URLs 10

https://server13.filesdumpplace.org/Glupteba botnet C2 (confidence level: 50%)
https://cerionetya.com/Buer botnet C2 (confidence level: 50%)
https://chrlerym.comGlupteba botnet C2 (confidence level: 50%)
https://nameiusr.comGlupteba botnet C2 (confidence level: 50%)
https://opsiters.comGlupteba botnet C2 (confidence level: 50%)
https://trumops.com/api/install-failurGlupteba botnet C2 (confidence level: 50%)
https://telete.in/youyouhell0worldRaccoon botnet C2 (confidence level: 50%)
http://196.251.115.22/panel/receive.phpBlackNET RAT botnet C2 (confidence level: 100%)
https://snowcjw.courses/apiLumma Stealer botnet C2 (confidence level: 100%)
https://hymenri.courses/apiLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 150

38.102.86.69AsyncRAT botnet C2 server (confidence level: 100%)
58.82.221.4Unknown malware botnet C2 server (confidence level: 100%)
13.250.209.136Unknown malware botnet C2 server (confidence level: 100%)
3.37.182.14Unknown malware botnet C2 server (confidence level: 100%)
162.19.92.7Unknown malware botnet C2 server (confidence level: 100%)
138.201.120.101Unknown malware botnet C2 server (confidence level: 100%)
108.137.95.18Unknown malware botnet C2 server (confidence level: 100%)
157.250.207.183Unknown malware botnet C2 server (confidence level: 100%)
37.27.90.2Unknown malware botnet C2 server (confidence level: 100%)
52.66.47.128Unknown malware botnet C2 server (confidence level: 100%)

Hashes 2

Unknown malware payload (confidence level: 50%)

36ccdc537914fc9375ebac92c660a8d4
f711847abff31937cebeb23c5d8cdc58

Description

ThreatFox IOCs for 2025-11-10

Impact

For European organizations, the impact of this threat is primarily related to the potential for undetected malware payload delivery via network activity that matches the shared IOCs. Since no specific malware or exploit details are provided, the direct impact is uncertain but could include unauthorized access, data exfiltration, or disruption if the payloads are successfully delivered and executed. The medium severity rating suggests a moderate risk level, emphasizing the importance of integrating these IOCs into security monitoring systems to detect and respond to suspicious network traffic. Organizations heavily reliant on OSINT and network-based threat intelligence will benefit from this data to preemptively identify malicious activity. However, without known active exploits or patches, the immediate operational impact is limited. The threat could be leveraged by adversaries to conduct reconnaissance or initial payload delivery stages, potentially leading to more severe downstream consequences if not detected. Thus, the impact is more on the detection and prevention side rather than direct exploitation at this stage.

Defensive guidance

1. Integrate ThreatFox IOCs into existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection of related network activity and payload delivery attempts. 2. Regularly update threat intelligence feeds and correlate with internal logs to identify suspicious patterns early. 3. Conduct network traffic analysis focusing on unusual payload delivery mechanisms or connections matching OSINT-derived indicators. 4. Implement strict network segmentation and least privilege principles to limit the impact of any successful payload delivery. 5. Train security operations teams to recognize and respond to alerts generated from these IOCs promptly. 6. Employ endpoint detection and response (EDR) tools to monitor for anomalous behavior that may follow payload delivery. 7. Maintain up-to-date asset inventories to prioritize monitoring of critical systems that could be targeted. 8. Collaborate with national and European cybersecurity centers to share intelligence and receive updates on evolving threats. These steps go beyond generic advice by emphasizing integration of OSINT-based IOCs into operational detection and response workflows and proactive network monitoring.

Community reviews

Loading reviews…