IndicatorPublished 18 Nov 2025Updated 19 Nov 2025

ThreatFox IOCs for 2025-11-18

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 180

docs.ledgerpropertiesllc.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
wald.c0nsiumpond.ruClearFake payload delivery domain (confidence level: 100%)
licht.c0nsiumpond.ruClearFake payload delivery domain (confidence level: 100%)
cloud.spyingte1ess.ruClearFake payload delivery domain (confidence level: 100%)
pfad.spyingte1ess.ruClearFake payload delivery domain (confidence level: 100%)
falke.spyingte1ess.ruClearFake payload delivery domain (confidence level: 100%)
r-funding.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
mreow.jumpingcrab.comMirai botnet C2 domain (confidence level: 100%)
xlab.ignorelist.comMirai botnet C2 domain (confidence level: 100%)
krebs.strangled.netMirai botnet C2 domain (confidence level: 100%)

URLs 16

https://upsistem32dat.com/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.fullhr.hu/Unknown malware payload delivery URL (confidence level: 90%)
http://195.178.136.19/gnulPhorpiex payload delivery URL (confidence level: 100%)
http://195.178.136.19/1Phorpiex payload delivery URL (confidence level: 100%)
http://195.178.136.19/2Phorpiex payload delivery URL (confidence level: 100%)
http://195.178.136.19/xmr.exePhorpiex payload delivery URL (confidence level: 100%)
http://45.153.34.175/c4e3d825c1654e79.phpStealc botnet C2 (confidence level: 50%)
http://185.177.239.95/Hook botnet C2 (confidence level: 50%)
https://api.telegram.org/bot7632193240:aaf8666jyzsbzl74jbf9vqmjkv7rrn8mrwc/Agent Tesla botnet C2 (confidence level: 50%)
https://akaishi-sankodo.co.jp/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 162

159.75.95.192Cobalt Strike botnet C2 server (confidence level: 100%)
106.52.207.50Cobalt Strike botnet C2 server (confidence level: 100%)
193.42.25.65Cobalt Strike botnet C2 server (confidence level: 100%)
78.100.179.27Quasar RAT botnet C2 server (confidence level: 100%)
78.100.179.27Quasar RAT botnet C2 server (confidence level: 100%)
78.100.179.27Quasar RAT botnet C2 server (confidence level: 100%)
78.100.179.27Quasar RAT botnet C2 server (confidence level: 100%)
78.100.179.27Quasar RAT botnet C2 server (confidence level: 100%)
78.100.179.27Quasar RAT botnet C2 server (confidence level: 100%)
78.100.179.27Quasar RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-11-18

Impact

For European organizations, the impact of this threat is currently limited due to the absence of known exploits and specific affected systems. However, the association with OSINT and network-based payload delivery means that if weaponized, it could facilitate initial compromise, data exfiltration, or lateral movement within networks. The medium severity rating reflects a moderate risk of confidentiality breaches or operational disruption if the malware evolves or is integrated into targeted campaigns. Organizations relying heavily on open-source intelligence tools or with extensive network exposure could face increased risk. The lack of patches or mitigation guidance means that detection and response capabilities are critical to minimizing impact. Potential impacts include unauthorized access, data leakage, or foothold establishment by threat actors. The threat's moderate distribution suggests some level of activity that could affect entities across Europe, especially those with high-value data or critical infrastructure. Overall, while immediate impact is low, the threat could escalate, necessitating proactive monitoring and incident readiness.

Defensive guidance

European organizations should enhance network monitoring to detect unusual payload delivery patterns and suspicious OSINT-related activities. Deploy advanced intrusion detection and prevention systems (IDS/IPS) with updated threat intelligence feeds, including ThreatFox and MISP data, to identify emerging indicators. Conduct regular threat hunting exercises focusing on network traffic anomalies and payload delivery vectors. Implement strict network segmentation to limit lateral movement if initial compromise occurs. Ensure endpoint detection and response (EDR) solutions are configured to detect unknown or suspicious payloads. Maintain updated asset inventories and monitor for unauthorized software or unusual network connections. Engage in information sharing with trusted partners and national cybersecurity centers to stay informed about evolving threats. Since no patches are available, emphasize rapid detection and containment strategies. Train security teams on interpreting OSINT-related threat intelligence and integrating it into operational workflows. Finally, review and update incident response plans to address potential malware delivery scenarios.

Community reviews

Loading reviews…