IndicatorPublished 25 Nov 2025Updated 26 Nov 2025

ThreatFox IOCs for 2025-11-25

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 299

funnel.weightlosstonight.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
www.cybermac.co.tzERMAC botnet C2 domain (confidence level: 100%)
wolke.sunb1aze.ruClearFake payload delivery domain (confidence level: 100%)
glade2.sunb1aze.ruClearFake payload delivery domain (confidence level: 100%)
reef.sunb1aze.ruClearFake payload delivery domain (confidence level: 100%)
crest.sunb1aze.ruClearFake payload delivery domain (confidence level: 100%)
e2h.s0ftmint.ruClearFake payload delivery domain (confidence level: 100%)
crest.st0nepeak.ruClearFake payload delivery domain (confidence level: 100%)
blink.st0nepeak.ruClearFake payload delivery domain (confidence level: 100%)
scg7.st0nepeak.ruClearFake payload delivery domain (confidence level: 100%)

URLs 135

http://213.5.130.84Unknown malware botnet C2 (confidence level: 100%)
http://213.5.130.96Unknown malware botnet C2 (confidence level: 100%)
http://213.5.130.98Unknown malware botnet C2 (confidence level: 100%)
http://213.5.130.160Unknown malware botnet C2 (confidence level: 100%)
http://213.5.130.94Unknown malware botnet C2 (confidence level: 100%)
http://185.206.149.217Unknown malware botnet C2 (confidence level: 100%)
http://217.156.8.58Unknown malware botnet C2 (confidence level: 100%)
http://185.206.149.215Unknown malware botnet C2 (confidence level: 100%)
http://217.156.8.59Unknown malware botnet C2 (confidence level: 100%)
http://85.208.84.242/auth/login/Matanbuchus botnet C2 (confidence level: 100%)

IP addresses 131

45.88.186.116XWorm botnet C2 server (confidence level: 77%)
158.94.210.84Latrodectus botnet C2 server (confidence level: 100%)
192.159.99.75Remcos botnet C2 server (confidence level: 100%)
185.113.10.171Sliver botnet C2 server (confidence level: 100%)
216.245.184.84SectopRAT botnet C2 server (confidence level: 100%)
46.250.233.154AdaptixC2 botnet C2 server (confidence level: 100%)
79.30.15.144Meterpreter botnet C2 server (confidence level: 100%)
18.212.114.81Meterpreter botnet C2 server (confidence level: 100%)
208.83.1.231Empire Downloader botnet C2 server (confidence level: 100%)
88.214.50.35SectopRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-11-25

Impact

For European organizations, the impact of this threat is primarily related to the potential detection and mitigation of malware campaigns that use the provided IOCs for network activity and payload delivery. While no direct exploitation or active attacks are reported, failure to incorporate these IOCs into security monitoring could result in missed detections of malware infections or command-and-control communications. This could lead to unauthorized data access, disruption of services, or lateral movement within networks. Sectors that heavily rely on OSINT tools or have extensive network infrastructures, such as finance, telecommunications, and government, may face increased risks. The medium severity rating suggests moderate potential impact on confidentiality and availability if malware leveraging these indicators is successfully deployed. However, the lack of patches or known exploits reduces the immediacy of the threat. Overall, the impact is contingent on the organization's ability to utilize the intelligence effectively to prevent or detect malware activity.

Defensive guidance

1. Integrate the ThreatFox IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection capabilities. 2. Employ network traffic analysis tools to monitor for suspicious payload delivery patterns and anomalous communications matching the IOCs. 3. Conduct regular threat hunting exercises using the updated IOCs to identify potential infections early. 4. Enhance employee awareness and training on recognizing phishing or social engineering attempts that could deliver malware payloads. 5. Implement strict network segmentation to limit lateral movement if malware is detected. 6. Maintain up-to-date backups and incident response plans tailored to malware infection scenarios. 7. Collaborate with national and European cybersecurity centers to share intelligence and receive timely updates on evolving threats. 8. Avoid reliance solely on signature-based detection; incorporate behavioral analytics to identify novel or obfuscated malware activity related to these IOCs.

Community reviews

Loading reviews…