IndicatorPublished 12 Nov 2025Updated 13 Nov 2025

ThreatFox IOCs for 2025-11-12

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 276

cmevents.liveUnknown malware payload delivery domain (confidence level: 100%)
doyarkaissela.comUnknown malware payload delivery domain (confidence level: 100%)
groupewadesecurity.comUnknown malware payload delivery domain (confidence level: 100%)
sahb.com.pkUnknown malware payload delivery domain (confidence level: 100%)
virhtechgmbh.comUnknown malware payload delivery domain (confidence level: 100%)
sportsstories.grUnknown malware payload delivery domain (confidence level: 100%)
archives.kathmandutribune.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
7qti.v3ctorplum.ruClearFake payload delivery domain (confidence level: 100%)
vector.v3ctorplum.ruClearFake payload delivery domain (confidence level: 100%)
xi.v3ctorplum.ruClearFake payload delivery domain (confidence level: 100%)

URLs 339

https://avx.advents-kalender.net/?benutzer_id=ffyszfk&unternehmensid=16499ded-3152-490eUnknown malware payload delivery URL (confidence level: 90%)
https://cmevents.proUnknown malware payload delivery URL (confidence level: 100%)
https://cosmicpharma-bd.comUnknown malware payload delivery URL (confidence level: 100%)
http://178.130.47.10Unknown malware botnet C2 (confidence level: 100%)
https://kke10.top/SpyNote botnet C2 (confidence level: 50%)
https://pastebin.com/raw/uschjeceAsyncRAT botnet C2 (confidence level: 50%)
http://aefoahefuaehfu.su/Phorpiex botnet C2 (confidence level: 50%)
http://aefoheaofefhuu.su/Phorpiex botnet C2 (confidence level: 50%)
http://aehfiaheifuedhgsf.su/Phorpiex botnet C2 (confidence level: 50%)
http://aehfiaheifuedhgsg.su/Phorpiex botnet C2 (confidence level: 50%)

IP addresses 112

79.133.51.116Mirai botnet C2 server (confidence level: 80%)
123.60.102.196Cobalt Strike botnet C2 server (confidence level: 100%)
124.71.229.16Unknown malware botnet C2 server (confidence level: 100%)
41.251.87.159AsyncRAT botnet C2 server (confidence level: 100%)
193.233.113.201Hook botnet C2 server (confidence level: 100%)
81.70.97.41Unknown malware botnet C2 server (confidence level: 100%)
3.66.37.128Unknown malware botnet C2 server (confidence level: 100%)
93.127.172.222Unknown malware botnet C2 server (confidence level: 100%)
51.77.46.214Unknown malware botnet C2 server (confidence level: 100%)
66.179.209.41Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-11-12

Impact

For European organizations, the potential impact of this threat is moderate but non-negligible. Since the threat involves malware payload delivery and network activity, successful exploitation could lead to unauthorized access, data exfiltration, or disruption of network services. The lack of specific affected products or versions suggests a broad attack surface, potentially affecting diverse sectors. Organizations relying heavily on OSINT feeds and network-based detection may face challenges in identifying this threat due to the absence of detailed IOCs. Critical infrastructure, financial institutions, and government agencies in Europe could be targeted due to their strategic importance and valuable data assets. The medium severity indicates that while immediate catastrophic impact is unlikely, persistent or targeted attacks leveraging this threat could degrade confidentiality, integrity, or availability over time. The absence of known exploits in the wild reduces immediate risk but does not eliminate the possibility of future exploitation. Overall, European entities should consider this threat as a moderate risk that requires proactive monitoring and preparedness.

Defensive guidance

1. Integrate ThreatFox and other reputable OSINT feeds into existing Security Information and Event Management (SIEM) and Intrusion Detection Systems (IDS) to enhance early detection capabilities. 2. Conduct regular network traffic analysis focusing on unusual payload delivery patterns and anomalous network activity that could indicate malware distribution attempts. 3. Implement strict network segmentation and access controls to limit the lateral movement of malware if initial compromise occurs. 4. Enhance endpoint detection and response (EDR) solutions to identify suspicious payload execution and behavior indicative of malware infection. 5. Train security teams to recognize and respond to emerging threats from OSINT sources, emphasizing the importance of threat intelligence validation. 6. Maintain up-to-date incident response plans that include procedures for handling malware infections and network intrusions. 7. Collaborate with national and European cybersecurity centers to share intelligence and receive timely alerts about evolving threats. 8. Regularly audit and update firewall and proxy rules to block known malicious payload delivery channels and suspicious network traffic patterns. These measures go beyond generic advice by focusing on operationalizing OSINT integration, network behavior analysis, and inter-organizational collaboration.

Community reviews

Loading reviews…