IndicatorPublished 14 Nov 2025Updated 15 Nov 2025

ThreatFox IOCs for 2025-11-14

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 229

catlover-pawpaw504.sbsUnknown Stealer botnet C2 domain (confidence level: 100%)
easternwhiskerholdings.sbsUnknown Stealer botnet C2 domain (confidence level: 100%)
puffyclaw2008.shopUnknown Stealer botnet C2 domain (confidence level: 100%)
cpanel.fjfrey.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
nakaizu.comKongTuke payload delivery domain (confidence level: 100%)
fcontrols.proUnknown malware payload delivery domain (confidence level: 100%)
dcontrols.proUnknown malware payload delivery domain (confidence level: 100%)
infernolo.comUnknown malware payload delivery domain (confidence level: 100%)
hcontrol.proUnknown malware payload delivery domain (confidence level: 100%)
3accdomain3.ruUnknown malware payload delivery domain (confidence level: 100%)

URLs 59

http://154.219.123.95:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://nakaizu.com/6h8h.jsKongTuke payload delivery URL (confidence level: 100%)
https://fcontrols.pro/xhamster.htmlUnknown malware payload delivery URL (confidence level: 100%)
http://194.87.55.59/rex.oddUnknown malware payload delivery URL (confidence level: 100%)
http://192.177.26.210/saver.oddUnknown malware payload delivery URL (confidence level: 100%)
https://dcontrols.pro/xhamster.htmlUnknown malware payload delivery URL (confidence level: 100%)
https://dcontrols.pro/xxx.htmlUnknown malware payload delivery URL (confidence level: 100%)
https://infernolo.com/xxx.htmlUnknown malware payload delivery URL (confidence level: 100%)
https://infernolo.com/xhamster.htmlUnknown malware payload delivery URL (confidence level: 100%)
https://hcontrol.pro/xxx.htmlUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 126

31.58.247.201Mirai botnet C2 server (confidence level: 80%)
102.205.170.10Quasar RAT botnet C2 server (confidence level: 100%)
102.205.170.10Quasar RAT botnet C2 server (confidence level: 100%)
102.205.170.10Quasar RAT botnet C2 server (confidence level: 100%)
102.205.170.10Quasar RAT botnet C2 server (confidence level: 100%)
102.205.170.10Quasar RAT botnet C2 server (confidence level: 100%)
102.205.170.10Quasar RAT botnet C2 server (confidence level: 100%)
102.205.170.10Quasar RAT botnet C2 server (confidence level: 100%)
45.153.34.35Bashlite botnet C2 server (confidence level: 100%)
139.59.23.248Quasar RAT botnet C2 server (confidence level: 75%)

Hashes 4

f89aab69e01d21b2c8ce2b8ee9909d25Unknown malware payload (confidence level: 100%)
42b9f136abd20cfe07cd08a9b1631ea8Unknown malware payload (confidence level: 100%)
e46f155df70c8a8c4506a2a42425c1a6Unknown malware payload (confidence level: 100%)
83ac4cb463bbbdab3c758f9fdfe0cc52c69364ec0ad9a21a8687dac28cd74c27BKA Trojaner payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-11-14

Impact

For European organizations, the impact of this threat is currently moderate due to the lack of specific exploit details or known active campaigns. However, the focus on OSINT and network-based payload delivery suggests potential risks in reconnaissance and initial access phases of cyberattacks. Organizations heavily reliant on open-source intelligence or with extensive network exposure could face increased risk of targeted payload delivery attempts. The absence of patches or mitigations indicates that if exploitation occurs, it may be difficult to counteract without proactive detection. Potential impacts include unauthorized access, data exfiltration, or disruption if payloads are successfully delivered and executed. The medium severity rating reflects these possibilities but also the current limited evidence of active exploitation. European entities in critical infrastructure, finance, or government sectors should remain vigilant given their attractiveness as targets and the strategic value of OSINT in attack planning.

Defensive guidance

Given the limited technical details, mitigation should focus on enhancing OSINT monitoring and network security posture. Organizations should integrate ThreatFox and similar OSINT feeds into their Security Information and Event Management (SIEM) systems to detect emerging indicators promptly. Network traffic analysis tools should be configured to identify unusual payload delivery patterns or suspicious communications. Employ strict network segmentation and enforce least privilege principles to limit payload propagation. Regularly update and patch all systems to reduce attack surface, even though no specific patches are available for this threat. Conduct employee training on recognizing phishing or social engineering attempts that may leverage OSINT-derived information. Collaborate with national Computer Security Incident Response Teams (CSIRTs) to share intelligence and receive timely alerts. Finally, implement robust endpoint detection and response (EDR) solutions to identify and contain payload execution attempts.

Community reviews

Loading reviews…