IndicatorPublished 11 Nov 2025Updated 12 Nov 2025

ThreatFox IOCs for 2025-11-11

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 231

flosinjs.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
eco-technic.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
flood.inkUnknown malware botnet C2 domain (confidence level: 100%)
vlrbq.fr0stharrow.ruClearFake payload delivery domain (confidence level: 100%)
shade.fr0stharrow.ruClearFake payload delivery domain (confidence level: 100%)
04ck.fr0stharrow.ruClearFake payload delivery domain (confidence level: 100%)
lhf.g0ldenspire.ruClearFake payload delivery domain (confidence level: 100%)
dfh.g0ldenspire.ruClearFake payload delivery domain (confidence level: 100%)
glen.g0ldenspire.ruClearFake payload delivery domain (confidence level: 100%)
qpn.ember-glade.ruClearFake payload delivery domain (confidence level: 100%)

URLs 113

http://114.132.250.118:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://162.250.127.182Unknown malware botnet C2 (confidence level: 100%)
http://107.149.142.35:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://flosinjs.com/xss/buf.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://flosinjs.com/xss/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://flosinjs.com/xss/bof.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://thehideawayvilla.com/qtvaz.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://eco-technic.com/kolaus.zipNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://196.251.88.204/bins/x86Unknown malware payload delivery URL (confidence level: 75%)
https://ultra-dynamic-systems-247-compute-portal.comStealc botnet C2 (confidence level: 100%)

IP addresses 127

103.163.118.111Mirai botnet C2 server (confidence level: 80%)
194.180.191.209NetSupportManager RAT botnet C2 server (confidence level: 100%)
15.235.61.204Havoc botnet C2 server (confidence level: 100%)
3.66.37.128Unknown malware botnet C2 server (confidence level: 100%)
18.142.92.43Unknown malware botnet C2 server (confidence level: 100%)
72.61.46.33Unknown malware botnet C2 server (confidence level: 100%)
23.95.214.101Unknown malware botnet C2 server (confidence level: 100%)
43.218.204.76Unknown malware botnet C2 server (confidence level: 100%)
89.169.169.28Unknown malware botnet C2 server (confidence level: 100%)
74.208.166.129Mirai botnet C2 server (confidence level: 80%)

Description

ThreatFox IOCs for 2025-11-11

Impact

For European organizations, the impact of this threat is potentially moderate. Since the threat involves malware-related network activity and payload delivery, successful exploitation could lead to unauthorized access, data exfiltration, or disruption of services. However, the absence of known exploits in the wild and no specific vulnerable software versions reduces the immediacy of risk. Organizations relying heavily on OSINT tools or exposed network services might be more susceptible to reconnaissance or initial compromise attempts. The threat could facilitate lateral movement or serve as a delivery mechanism for more damaging payloads if leveraged by attackers. The medium severity suggests that while the threat is not critical, it warrants attention to prevent escalation. Disruption to confidentiality, integrity, or availability could occur if payloads are successfully delivered and executed, impacting business operations and sensitive data security.

Defensive guidance

European organizations should prioritize integrating the provided IOCs into their Security Information and Event Management (SIEM) systems and threat intelligence platforms to enhance detection of related network activity and payload delivery attempts. Network segmentation and strict access controls can limit the spread of malware if initial compromise occurs. Regularly updating and hardening OSINT tools and related infrastructure reduces exposure to exploitation. Employing advanced network monitoring techniques, such as anomaly detection and deep packet inspection, can identify suspicious payload delivery patterns. Incident response teams should prepare playbooks specific to malware delivery scenarios indicated by these IOCs. Collaboration with national cybersecurity centers and sharing updated threat intelligence will improve collective defense. Since no patches are available, focus should be on detection, containment, and rapid response rather than remediation of a vulnerability. User training on phishing and social engineering can reduce the risk of initial infection vectors often associated with payload delivery.

Community reviews

Loading reviews…