IndicatorPublished 22 Nov 2025Updated 23 Nov 2025

ThreatFox IOCs for 2025-11-22

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 254

validate-3748-captcha-2920-8237.clickUnknown malware payload delivery domain (confidence level: 100%)
arrenegade.comUnknown malware payload delivery domain (confidence level: 100%)
lentdwn.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
polucxs.cyouLumma Stealer botnet C2 domain (confidence level: 75%)
atabriq.qponLumma Stealer botnet C2 domain (confidence level: 75%)
bivaluz.qponLumma Stealer botnet C2 domain (confidence level: 75%)
catwzit.qponLumma Stealer botnet C2 domain (confidence level: 75%)
cornxm.qponLumma Stealer botnet C2 domain (confidence level: 75%)
lubberf.qponLumma Stealer botnet C2 domain (confidence level: 75%)
oryzac.qponLumma Stealer botnet C2 domain (confidence level: 75%)

URLs 61

https://www.mantraservices.co.uk/Unknown malware payload delivery URL (confidence level: 90%)
https://validate-3748-captcha-2920-8237.clickUnknown malware payload delivery URL (confidence level: 100%)
https://arrenegade.com/211101.wavUnknown malware payload delivery URL (confidence level: 100%)
https://ashaherq.com/approve/otp2.htmlUnknown malware payload delivery URL (confidence level: 90%)
https://title-car.info/Unknown malware payload delivery URL (confidence level: 90%)
https://nicoras.net/Unknown malware payload delivery URL (confidence level: 90%)
http://52.230.7.104:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://j88r.net/Unknown malware payload delivery URL (confidence level: 90%)
https://kurama.ltd/Unknown malware botnet C2 (confidence level: 50%)
https://salator.es/sa1at/2or/SalatStealer botnet C2 (confidence level: 50%)

IP addresses 84

186.169.80.57Remcos botnet C2 server (confidence level: 100%)
176.117.107.13Remcos botnet C2 server (confidence level: 100%)
91.231.222.182Remcos botnet C2 server (confidence level: 100%)
147.124.218.193Remcos botnet C2 server (confidence level: 100%)
151.243.109.61Sliver botnet C2 server (confidence level: 100%)
103.116.52.231MooBot botnet C2 server (confidence level: 100%)
193.161.193.99Nanocore RAT botnet C2 server (confidence level: 100%)
39.100.71.237Cobalt Strike botnet C2 server (confidence level: 100%)
199.217.99.47Remcos botnet C2 server (confidence level: 100%)
193.134.209.94Sliver botnet C2 server (confidence level: 100%)

Hashes 1

Unknown RAT payload (confidence level: 100%)

5902640be1d1e83848e2ba869e5acbf8317470993943c237666b7dc617ed8628

Description

ThreatFox IOCs for 2025-11-22

Impact

For European organizations, this threat could lead to unauthorized payload delivery within corporate or critical infrastructure networks, potentially compromising confidentiality, integrity, or availability depending on the payload's nature. The lack of known exploits and patches suggests limited immediate risk but underscores the need for vigilance as the threat could evolve. Organizations relying heavily on OSINT tools or those with extensive networked environments may face increased exposure to this malware's delivery and propagation mechanisms. Potential impacts include data exfiltration, disruption of network services, or foothold establishment by threat actors. The medium severity indicates that while the threat is not currently critical, it could escalate if exploitation techniques or payloads become more sophisticated or widespread.

Defensive guidance

European organizations should enhance network monitoring to detect unusual payload delivery and network activity patterns associated with this threat. Integration of updated threat intelligence feeds, including ThreatFox IOCs, into Security Information and Event Management (SIEM) systems can improve detection capabilities. Conduct regular OSINT tool audits to ensure they are securely configured and updated. Implement strict network segmentation to limit lateral movement in case of compromise. Employ behavioral analytics to identify anomalous activities indicative of payload delivery or malware communication. Train security teams to recognize and respond to emerging threats reported in intelligence feeds. Since no patches are available, focus on proactive detection and incident response readiness. Collaborate with national cybersecurity centers to share intelligence and best practices related to this threat.

Community reviews

Loading reviews…