IndicatorPublished 24 Nov 2025Updated 25 Nov 2025

ThreatFox IOCs for 2025-11-24

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 207

fluss.snowl1ne.ruClearFake payload delivery domain (confidence level: 100%)
tau.snowl1ne.ruClearFake payload delivery domain (confidence level: 100%)
dorn4.snowl1ne.ruClearFake payload delivery domain (confidence level: 100%)
wald.snowl1ne.ruClearFake payload delivery domain (confidence level: 100%)
ufer.oceanbyte.ruClearFake payload delivery domain (confidence level: 100%)
stern.oceanbyte.ruClearFake payload delivery domain (confidence level: 100%)
gleis3.oceanbyte.ruClearFake payload delivery domain (confidence level: 100%)
rauch.darkspark.ruClearFake payload delivery domain (confidence level: 100%)
bach2.darkspark.ruClearFake payload delivery domain (confidence level: 100%)
wolke.darkspark.ruClearFake payload delivery domain (confidence level: 100%)

URLs 72

http://dobriykaba.temp.swtest.ru/432b62ce.phpDCRat botnet C2 (confidence level: 100%)
http://43.138.38.26:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://129.28.177.133:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://workingboss3.ydns.eu:7076/is-readyHoudini botnet C2 (confidence level: 100%)
http://211.252.152.47/js/lw.txtXbash payload delivery URL (confidence level: 100%)
https://www.phuketia.com/Unknown malware payload delivery URL (confidence level: 90%)
http://198.23.177.219/siu/pin.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
https://www.jyoushin-solar.com/Unknown malware payload delivery URL (confidence level: 90%)
http://212.11.64.228Stealc botnet C2 (confidence level: 100%)
https://prsuerinkicon.todayUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 112

8.152.5.66Cobalt Strike botnet C2 server (confidence level: 100%)
5.133.102.229DarkComet botnet C2 server (confidence level: 100%)
200.124.43.56AsyncRAT botnet C2 server (confidence level: 100%)
34.163.71.222Unknown malware botnet C2 server (confidence level: 100%)
196.2.67.6Unknown malware botnet C2 server (confidence level: 100%)
45.8.226.140Unknown malware botnet C2 server (confidence level: 100%)
91.199.209.113Unknown malware botnet C2 server (confidence level: 100%)
13.127.23.22Unknown malware botnet C2 server (confidence level: 100%)
45.143.167.33Remcos botnet C2 server (confidence level: 100%)
167.86.89.37Remcos botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-11-24

Impact

For European organizations, the impact of this threat is currently limited due to the absence of known exploits and specific affected products. However, the presence of malware-related IOCs associated with OSINT and network activity indicates potential reconnaissance or preparatory stages of an attack, which could precede more targeted payload delivery attempts. If leveraged effectively by threat actors, these activities could lead to unauthorized access, data exfiltration, or disruption of services. The medium severity rating suggests moderate risk, with potential impacts on confidentiality and availability if subsequent exploitation occurs. Organizations heavily reliant on networked infrastructure and those engaged in sensitive or critical operations may face increased risk if these IOCs correlate with active threat campaigns. Continuous monitoring and integration of these IOCs into security operations can help mitigate potential impacts by enabling early detection and response. The lack of patches or mitigations means that defensive measures must focus on detection and prevention rather than remediation of a known vulnerability.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and threat intelligence platforms to enhance detection capabilities. 2. Increase network monitoring for unusual or suspicious OSINT-related activities and payload delivery attempts, focusing on anomalous traffic patterns. 3. Conduct regular threat hunting exercises using updated intelligence feeds, including ThreatFox, to identify potential early indicators of compromise. 4. Ensure that endpoint detection and response (EDR) solutions are configured to detect behaviors associated with reconnaissance and payload delivery phases. 5. Maintain strict network segmentation and access controls to limit lateral movement should an initial compromise occur. 6. Train security teams to recognize and respond to OSINT-based reconnaissance tactics and payload delivery mechanisms. 7. Collaborate with national and European cybersecurity centers to share intelligence and receive updates on evolving threats. 8. Since no patches are available, prioritize proactive detection and incident response readiness over reactive patch management for this threat. 9. Regularly update and test incident response plans to incorporate scenarios involving OSINT-driven malware campaigns. 10. Employ deception technologies or honeypots to detect and analyze reconnaissance activities related to this threat.

Community reviews

Loading reviews…