IndicatorPublished 15 Nov 2025Updated 16 Nov 2025

ThreatFox IOCs for 2025-11-15

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 186

leathes.qponLumma Stealer botnet C2 domain (confidence level: 100%)
drugtrh.qponLumma Stealer botnet C2 domain (confidence level: 100%)
aasdtvcvchcvhhhhh.comUnknown malware payload delivery domain (confidence level: 100%)
ldasldalsd.comUnknown malware payload delivery domain (confidence level: 100%)
sistemdetect.comUnknown malware payload delivery domain (confidence level: 100%)
uploadclient32.comUnknown malware payload delivery domain (confidence level: 100%)
bindlib.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
moor.saffronhafen.ruClearFake payload delivery domain (confidence level: 100%)
klee.saffronhafen.ruClearFake payload delivery domain (confidence level: 100%)
glut.saffronhafen.ruClearFake payload delivery domain (confidence level: 100%)

URLs 333

http://194.38.20.95/monoPhorpiex payload delivery URL (confidence level: 100%)
http://194.38.20.95/1Phorpiex payload delivery URL (confidence level: 100%)
http://194.38.20.95/2Phorpiex payload delivery URL (confidence level: 100%)
http://194.38.20.95/xmr.exePhorpiex payload delivery URL (confidence level: 100%)
https://aasdtvcvchcvhhhhh.com/oototUnknown malware payload delivery URL (confidence level: 100%)
https://ldasldalsd.com/asgg.jsUnknown malware payload delivery URL (confidence level: 100%)
https://sistemdetect.com/client32.wavUnknown malware payload delivery URL (confidence level: 100%)
https://uploadclient32.com/client32.wavUnknown malware payload delivery URL (confidence level: 100%)
https://bindlib.com/xss/buf.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://bindlib.com/xss/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)

IP addresses 61

213.209.143.34Mirai botnet C2 server (confidence level: 80%)
103.133.178.24Quasar RAT botnet C2 server (confidence level: 100%)
3.101.56.242NetSupportManager RAT botnet C2 server (confidence level: 100%)
5.22.214.179MimiKatz botnet C2 server (confidence level: 100%)
4.209.183.220AdaptixC2 botnet C2 server (confidence level: 100%)
175.24.73.192AdaptixC2 botnet C2 server (confidence level: 100%)
87.120.93.66Cobalt Strike botnet C2 server (confidence level: 100%)
82.223.101.63AsyncRAT botnet C2 server (confidence level: 100%)
37.221.66.166SectopRAT botnet C2 server (confidence level: 100%)
188.225.73.201Chaos botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-11-15

Impact

For European organizations, this threat could lead to unauthorized network access, malware infection, and potential data exfiltration or disruption of services. Since the threat involves payload delivery and network activity, it may affect critical infrastructure, government agencies, and enterprises relying on open-source intelligence tools or exposed network services. The medium severity suggests that while the threat is not immediately critical, it could escalate if adversaries develop exploits or expand distribution. The lack of known exploits in the wild currently limits immediate impact, but the potential for reconnaissance and payload delivery means organizations could face targeted attacks or supply chain compromises. Disruption to confidentiality, integrity, and availability could occur if malware payloads are successfully delivered and executed. European entities with high digital dependency and interconnected networks are particularly at risk, especially if they lack robust network monitoring and threat intelligence capabilities.

Defensive guidance

1. Implement advanced network traffic monitoring and anomaly detection to identify unusual payload delivery attempts or OSINT-related reconnaissance activities. 2. Integrate ThreatFox and other OSINT feeds into existing SIEM and SOAR platforms to enhance early detection of emerging threats. 3. Conduct regular threat hunting exercises focusing on network activity patterns associated with payload delivery. 4. Enforce strict network segmentation to limit lateral movement in case of successful compromise. 5. Harden perimeter defenses, including firewalls and intrusion prevention systems, to block known malicious payload delivery vectors. 6. Educate security teams on emerging OSINT-based threat tactics to improve incident response readiness. 7. Maintain up-to-date asset inventories and vulnerability assessments to quickly identify and remediate potential exposure points. 8. Collaborate with national cybersecurity centers and information sharing organizations to stay informed about evolving threats and mitigation strategies.

Community reviews

Loading reviews…