IndicatorPublished 13 Nov 2025Updated 14 Nov 2025

ThreatFox IOCs for 2025-11-13

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 195

updatesbrows.appUnknown malware payload delivery domain (confidence level: 100%)
bcidaho.247supportsolutions.comUnknown malware botnet C2 domain (confidence level: 100%)
suz.mirage-pad.ruClearFake payload delivery domain (confidence level: 100%)
glide.twistnova.ruClearFake payload delivery domain (confidence level: 100%)
vi.twistnova.ruClearFake payload delivery domain (confidence level: 100%)
sparkle.twistnova.ruClearFake payload delivery domain (confidence level: 100%)
f1o.twistnova.ruClearFake payload delivery domain (confidence level: 100%)
5cg77.miragepad.ruClearFake payload delivery domain (confidence level: 100%)
crest4.miragepad.ruClearFake payload delivery domain (confidence level: 100%)
orbit1.miragepad.ruClearFake payload delivery domain (confidence level: 100%)

URLs 231

http://178.130.47.11Unknown malware botnet C2 (confidence level: 100%)
http://178.130.47.12Unknown malware botnet C2 (confidence level: 100%)
http://178.130.47.13Unknown malware botnet C2 (confidence level: 100%)
http://178.130.47.133Unknown malware botnet C2 (confidence level: 100%)
http://178.130.47.134Unknown malware botnet C2 (confidence level: 100%)
http://178.130.47.135Unknown malware botnet C2 (confidence level: 100%)
http://178.130.47.136Unknown malware botnet C2 (confidence level: 100%)
http://178.130.47.137Unknown malware botnet C2 (confidence level: 100%)
http://178.130.47.138Unknown malware botnet C2 (confidence level: 100%)
http://178.130.47.139Unknown malware botnet C2 (confidence level: 100%)

IP addresses 1,059

43.252.159.76Loki Password Stealer (PWS) botnet C2 server (confidence level: 75%)
62.60.226.183Tofsee botnet C2 server (confidence level: 100%)
213.21.239.39Unknown malware botnet C2 server (confidence level: 100%)
34.41.169.247Unknown malware botnet C2 server (confidence level: 100%)
45.76.190.68Unknown malware botnet C2 server (confidence level: 100%)
128.199.22.86Quasar RAT botnet C2 server (confidence level: 100%)
64.226.105.95PoshC2 botnet C2 server (confidence level: 100%)
101.58.219.140Unknown malware botnet C2 server (confidence level: 100%)
34.59.70.191Unknown malware botnet C2 server (confidence level: 100%)
157.230.163.13Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-11-13

Impact

For European organizations, the impact of this threat is primarily related to the potential for malware payload delivery and network-based reconnaissance activities. While no direct exploits or vulnerabilities are identified, the presence of such threat intelligence can indicate ongoing or emerging malware campaigns that could target network infrastructure or endpoints. Organizations that do not integrate OSINT feeds like ThreatFox into their security monitoring may miss early warning signs of attacks, leading to delayed detection and response. The medium severity suggests a moderate risk of operational disruption, data compromise, or network infiltration if the malware payloads are successfully delivered and executed. The lack of specific affected products or versions means the threat could be broad, potentially impacting various sectors including finance, critical infrastructure, and government entities. European organizations with complex network environments and high-value data assets are at risk of targeted payload delivery attempts exploiting network activity patterns. The absence of patches or known exploits means that traditional vulnerability management is less applicable, increasing reliance on proactive threat hunting and network defense strategies. Overall, the impact is situational and depends on the organization's ability to leverage threat intelligence and maintain robust network security postures.

Defensive guidance

European organizations should enhance their security operations by integrating ThreatFox and similar OSINT feeds into their Security Information and Event Management (SIEM) and threat intelligence platforms to improve detection of malware-related network activity and payload delivery attempts. Implement network segmentation and strict egress filtering to limit the spread and communication capabilities of potential malware payloads. Deploy advanced endpoint detection and response (EDR) solutions capable of identifying suspicious payload execution and lateral movement. Conduct regular threat hunting exercises focusing on network anomalies and unusual payload delivery patterns informed by the latest OSINT indicators. Maintain up-to-date network intrusion detection/prevention systems (IDS/IPS) with signatures and heuristics tuned to detect emerging malware behaviors. Train security analysts to interpret and act on OSINT data effectively, ensuring timely incident response. Since no patches are available, emphasize layered security controls, including application whitelisting, behavior monitoring, and strict access controls. Collaborate with national and European cybersecurity agencies to share intelligence and receive alerts on evolving threats. Finally, ensure robust logging and monitoring of network traffic to facilitate forensic analysis and rapid containment if suspicious activity is detected.

Community reviews

Loading reviews…