IndicatorPublished 19 Nov 2025Updated 20 Nov 2025

ThreatFox IOCs for 2025-11-19

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 217

vcc-library.ukUnknown Stealer botnet C2 domain (confidence level: 100%)
digital-marketing-pro-365.comUnknown malware botnet C2 domain (confidence level: 100%)
wee-wee-gachi-master.comUnknown malware botnet C2 domain (confidence level: 100%)
newtry.appUnknown RAT botnet C2 domain (confidence level: 100%)
weald.0akstream.ruClearFake payload delivery domain (confidence level: 100%)
harbr.deepv0yage.ruClearFake payload delivery domain (confidence level: 100%)
gleem.deepv0yage.ruClearFake payload delivery domain (confidence level: 100%)
trakk.deepv0yage.ruClearFake payload delivery domain (confidence level: 100%)
wolke.deepv0yage.ruClearFake payload delivery domain (confidence level: 100%)
pfed.deepv0yage.ruClearFake payload delivery domain (confidence level: 100%)

URLs 86

http://202.155.141.62:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://digital-marketing-pro-365.com/api/uploadUnknown malware botnet C2 (confidence level: 100%)
https://digital-marketing-pro-365.com/api/tasksUnknown malware botnet C2 (confidence level: 100%)
http://4.221.211.80:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://14.128.53.148:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://playgoogle-gpttrade.com/gpt%20trade.apkUnknown malware payload delivery URL (confidence level: 50%)
http://95.164.53.100/private/yarsap_80541.phpUnknown malware botnet C2 (confidence level: 50%)
http://95.164.53.100:8080/Unknown malware botnet C2 (confidence level: 50%)
http://185.196.10.188Amadey botnet C2 (confidence level: 100%)
http://45.159.189.140Amadey botnet C2 (confidence level: 100%)

IP addresses 129

202.155.141.62Unknown malware botnet C2 server (confidence level: 100%)
45.83.207.191Mirai botnet C2 server (confidence level: 80%)
154.6.197.36Mirai botnet C2 server (confidence level: 80%)
213.209.143.62Mirai botnet C2 server (confidence level: 80%)
35.192.163.54Unknown malware botnet C2 server (confidence level: 100%)
85.9.200.153MimiKatz botnet C2 server (confidence level: 100%)
168.245.200.119Meterpreter botnet C2 server (confidence level: 100%)
77.110.114.65PureLogs Stealer botnet C2 server (confidence level: 100%)
144.76.96.36PureLogs Stealer botnet C2 server (confidence level: 100%)
37.221.93.81Mirai botnet C2 server (confidence level: 100%)

Hashes 3

Unknown malware payload (confidence level: 50%)

0a542751724a432a8448324613e0ce10393e41739a1800cbb7d5a2c648fcdc35
918f002a41f9551d48ece999ccba504fcf7596017d9566c07c5335fe0081effe
7f005c10f80372311e9c038526d81d931672d15c644fef2a77eefd67c6235917

Description

ThreatFox IOCs for 2025-11-19

Impact

For European organizations, the threat poses a moderate risk primarily to confidentiality and integrity due to its OSINT and payload delivery nature. Organizations heavily reliant on open-source intelligence tools or those with exposed network services may be targeted for reconnaissance or initial compromise. The lack of known exploits and patches suggests the threat may exploit operational security weaknesses or social engineering rather than software vulnerabilities. Potential impacts include unauthorized data collection, network infiltration, and subsequent payload execution leading to data exfiltration or lateral movement within networks. The medium severity rating implies that while the threat is not immediately critical, it could escalate if leveraged by more capable adversaries or combined with other attack vectors. Disruption of availability is less likely based on current information, but indirect effects such as operational delays or incident response costs could be significant. European sectors with high-value intelligence or critical infrastructure may face increased targeting, necessitating enhanced monitoring and threat intelligence sharing.

Defensive guidance

European organizations should implement targeted mitigations beyond generic advice by: 1) Enhancing network traffic monitoring with a focus on detecting unusual payload delivery patterns and OSINT-related reconnaissance activities. 2) Integrating ThreatFox and other OSINT feeds into Security Information and Event Management (SIEM) systems to improve detection of emerging IOCs once available. 3) Conducting regular threat hunting exercises focused on network activity anomalies and potential payload delivery channels. 4) Restricting and segmenting network access to limit lateral movement opportunities for malware payloads. 5) Training security teams to recognize early signs of OSINT-based reconnaissance and payload delivery tactics. 6) Collaborating with national Computer Emergency Response Teams (CERTs) and sharing intelligence to stay updated on evolving threats. 7) Reviewing and hardening configurations of OSINT tools and network services to reduce exposure. 8) Employing endpoint detection and response (EDR) solutions capable of identifying suspicious payload execution behaviors. These steps will help mitigate the risk posed by this medium-level threat and improve overall resilience against similar malware campaigns.

Community reviews

Loading reviews…