IndicatorPublished 16 Nov 2025Updated 17 Nov 2025

ThreatFox IOCs for 2025-11-16

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 641

varktechltd.comUnknown malware payload delivery domain (confidence level: 100%)
medinbusiness.storeUnknown malware payload delivery domain (confidence level: 100%)
getshelters.comUnknown malware payload delivery domain (confidence level: 100%)
ync-web.comUnknown malware payload delivery domain (confidence level: 100%)
calismaiznibasvurusu.comUnknown malware payload delivery domain (confidence level: 100%)
sbpmr.frUnknown malware payload delivery domain (confidence level: 100%)
oppaimon.comUnknown malware payload delivery domain (confidence level: 100%)
vodlia.comUnknown malware payload delivery domain (confidence level: 100%)
frx.kindnessbrand.comVidar botnet C2 domain (confidence level: 100%)
elle.digipeeps.onlineUnknown malware payload delivery domain (confidence level: 100%)

URLs 494

https://pastebin.com/raw/axkuu4dyQuasar RAT payload delivery URL (confidence level: 100%)
http://updatemicrosoftonline.arkelconstructor.com/agent_chrome_update_v10_14_4_rw.zipUnknown malware payload delivery URL (confidence level: 100%)
http://45.38.20.224/pages/login.phpUnknown malware botnet C2 (confidence level: 100%)
https://xshby.com/Unknown malware payload delivery URL (confidence level: 90%)
https://tsutsuifujiko.com/Unknown malware payload delivery URL (confidence level: 90%)
https://pokkaloh.com/Unknown malware payload delivery URL (confidence level: 90%)
https://archilabdesigns.com/Unknown malware payload delivery URL (confidence level: 90%)
https://adultgamesps4.com/Unknown malware payload delivery URL (confidence level: 90%)
https://sleepkids.app/Unknown malware payload delivery URL (confidence level: 90%)
https://tildotsignatures.com/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 95

5.75.210.163Vidar botnet C2 server (confidence level: 100%)
176.123.1.63Mirai botnet C2 server (confidence level: 80%)
154.6.197.52Mirai botnet C2 server (confidence level: 80%)
82.146.49.236Cobalt Strike botnet C2 server (confidence level: 100%)
38.242.208.134Remcos botnet C2 server (confidence level: 100%)
123.11.165.216Unknown malware botnet C2 server (confidence level: 100%)
196.251.107.61Stealc botnet C2 server (confidence level: 100%)
115.190.22.7xmrig botnet C2 server (confidence level: 100%)
54.242.144.125Meterpreter botnet C2 server (confidence level: 100%)
139.159.183.246Meterpreter botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-11-16

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing detection capabilities rather than mitigating an active exploit. The medium severity suggests that while the threat is not immediately critical, it could facilitate malware payload delivery and network intrusion if leveraged by adversaries. Organizations relying on threat intelligence feeds like ThreatFox can improve their security posture by incorporating these IOCs into their monitoring systems, potentially reducing dwell time and preventing lateral movement within networks. The absence of known exploits and patches means there is no direct vulnerability to remediate, but failure to utilize this intelligence could result in missed detection opportunities. Critical infrastructure sectors, financial institutions, and government agencies in Europe could face increased risk if adversaries use similar payload delivery techniques to compromise networks. The threat’s network activity focus underscores the need for robust network segmentation, anomaly detection, and incident response readiness. Overall, the impact is moderate but underscores the importance of threat intelligence integration in European cybersecurity strategies.

Defensive guidance

1. Integrate the provided IOCs from the ThreatFox MISP feed into existing Security Information and Event Management (SIEM) systems and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection of related malware activity. 2. Conduct regular threat hunting exercises using these IOCs to identify potential payload delivery attempts or suspicious network activity within organizational environments. 3. Employ network segmentation and strict access controls to limit the spread of malware if payload delivery is successful. 4. Maintain up-to-date endpoint detection and response (EDR) solutions capable of recognizing behaviors associated with the identified threat categories. 5. Train security operations teams to recognize and respond to network anomalies and payload delivery indicators highlighted by this intelligence. 6. Share relevant findings and updates with industry Information Sharing and Analysis Centers (ISACs) to improve collective defense. 7. Since no patches are available, focus on detection and containment strategies rather than remediation. 8. Regularly update and validate threat intelligence feeds to ensure timely incorporation of new indicators. 9. Implement strict network monitoring for unusual outbound connections that may indicate command and control communications. 10. Review and update incident response plans to include scenarios involving payload delivery and network-based malware threats.

Community reviews

Loading reviews…