IndicatorPublished 21 Nov 2025Updated 22 Nov 2025

ThreatFox IOCs for 2025-11-21

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 195

gog.nigeriaafricatime.comVidar botnet C2 domain (confidence level: 100%)
tgk.clashofmaps.vipVidar botnet C2 domain (confidence level: 100%)
api.cpibot.comUnknown Loader payload delivery domain (confidence level: 90%)
portabalbufe.comUnknown malware botnet C2 domain (confidence level: 50%)
kamm.m1ntcioud.ruClearFake payload delivery domain (confidence level: 100%)
glanz7.m1ntcioud.ruClearFake payload delivery domain (confidence level: 100%)
weiss.m1ntcioud.ruClearFake payload delivery domain (confidence level: 100%)
bach.stormpeak.ruClearFake payload delivery domain (confidence level: 100%)
tal.stormpeak.ruClearFake payload delivery domain (confidence level: 100%)
grat.stormpeak.ruClearFake payload delivery domain (confidence level: 100%)

URLs 42

https://31.129.54.227/Vidar botnet C2 (confidence level: 100%)
http://91.92.243.129/0gjsy4hf3/login.phpAmadey botnet C2 (confidence level: 100%)
https://seiho-ouyou.com/Unknown malware payload delivery URL (confidence level: 90%)
https://bongoshare.bishtelecom.com/Unknown malware payload delivery URL (confidence level: 90%)
https://xerovent.org/Unknown malware payload delivery URL (confidence level: 90%)
https://lcontrols4.ru/xhamster.htmlUnknown malware payload delivery URL (confidence level: 90%)
https://workcrms.abesecom.co.in/Unknown malware payload delivery URL (confidence level: 90%)
http://cd672412.tw1.ru/d8123622.phpDCRat botnet C2 (confidence level: 100%)
http://156.252.63.98:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://158.94.208.130Stealc botnet C2 (confidence level: 100%)

IP addresses 122

31.129.54.227Vidar botnet C2 server (confidence level: 75%)
193.233.245.114Pink botnet C2 server (confidence level: 100%)
123.58.64.57Cobalt Strike botnet C2 server (confidence level: 100%)
91.231.222.184Remcos botnet C2 server (confidence level: 100%)
104.168.5.56Remcos botnet C2 server (confidence level: 100%)
77.90.185.239SectopRAT botnet C2 server (confidence level: 100%)
95.111.217.209MimiKatz botnet C2 server (confidence level: 100%)
165.232.126.106AdaptixC2 botnet C2 server (confidence level: 100%)
175.17.182.112Meterpreter botnet C2 server (confidence level: 100%)
193.161.193.99Quasar RAT botnet C2 server (confidence level: 100%)

Hashes 19

59d3a806684dfc3e0d6a9fac5f349e0a08a628e9307acbc29b14012f8dd9c48cVidar payload (confidence level: 100%)
80ea6b70823ebc4f76d9af3e72c268862c5a1deeacc09066e1c87636a46c0866Vidar payload (confidence level: 100%)
a6dfdfa0dda4c9b2d3767ed44b49f858c2df2f049b8606f85c0219076ad91111Vidar payload (confidence level: 100%)
e33e882a1bf4ef13b23f33e76575fac5e48b265b316727e462109fb8bd0d9a35Vidar payload (confidence level: 100%)
f42b4366500178d40380d21433efea12cdc5aa66eebb74ec6820adf00a29ae6bVidar payload (confidence level: 100%)
2178a927cb1486293bb77fc394dc53d7dd7b1b3c1a97b4f84591616d4c921eddVidar payload (confidence level: 100%)
68bd4f1a56632380307f892f32e59e481269caabd1d076abf6a824ace474d82eVidar payload (confidence level: 100%)
b250ef40ab3cc5cae98cab7da42245f1b30021b52082d8fa83f5b550c8997478Vidar payload (confidence level: 100%)
c42fccdf608e98be7739915a086f49c3bb7328ae3fc3662b1abc2894a9792570Vidar payload (confidence level: 100%)
d1ec6b46ad22793485504e969661c9e79c5a3f8b84a5e76538955a6c684300b1Vidar payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-11-21

Impact

For European organizations, the impact of these IOCs depends largely on their ability to integrate and act upon threat intelligence feeds. Since no specific exploits or vulnerabilities are identified, the immediate risk is low to medium. However, the presence of network activity and payload delivery indicators suggests a potential for malware infections if these IOCs correspond to active or emerging threats. Organizations with extensive network infrastructure and critical services could face disruptions or data breaches if such payloads are successfully delivered and executed. The lack of patches or fixes means that prevention relies heavily on detection and response capabilities. Failure to incorporate these IOCs into security monitoring could result in delayed detection of malware campaigns, increasing the risk of compromise. Additionally, the medium severity rating indicates that while the threat is not critical, it should not be ignored, especially in sectors with high-value data or critical infrastructure. The impact is also influenced by the organization's maturity in threat intelligence consumption and network security posture.

Defensive guidance

To mitigate risks associated with these ThreatFox IOCs, European organizations should: 1) Integrate the ThreatFox MISP feed and similar OSINT sources into their Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enable real-time detection of related indicators. 2) Enhance network monitoring to identify unusual or suspicious payload delivery attempts, focusing on traffic patterns that match the characteristics of the shared IOCs. 3) Conduct regular threat hunting exercises using the updated IOCs to proactively identify potential compromises. 4) Implement strict network segmentation and access controls to limit the spread of malware if payload delivery occurs. 5) Educate security teams on interpreting and operationalizing OSINT feeds to improve response times. 6) Maintain up-to-date backups and incident response plans to minimize impact in case of infection. 7) Collaborate with national and European cybersecurity centers to share intelligence and receive timely alerts about emerging threats. These steps go beyond generic advice by emphasizing the operational integration of threat intelligence and proactive network defense tailored to the nature of the IOCs.

Community reviews

Loading reviews…