IndicatorPublished 27 Nov 2025Updated 28 Nov 2025

ThreatFox IOCs for 2025-11-27

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 279

control.myaffiliateincome.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
cryptoinfa.comUnknown malware payload delivery domain (confidence level: 100%)
braun5.copperweide8.ruClearFake payload delivery domain (confidence level: 100%)
yoxel2.copperweide8.ruClearFake payload delivery domain (confidence level: 100%)
rava7n.ravenstein.ruClearFake payload delivery domain (confidence level: 100%)
eis3en.ravenstein.ruClearFake payload delivery domain (confidence level: 100%)
korvo5.ravenstein.ruClearFake payload delivery domain (confidence level: 100%)
steyn4.ravenstein.ruClearFake payload delivery domain (confidence level: 100%)
noxil7.ravenstein.ruClearFake payload delivery domain (confidence level: 100%)
mapl3e.maplekueste.ruClearFake payload delivery domain (confidence level: 100%)

URLs 56

http://47.236.194.231:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://185.163.204.237/google.jsonUnknown malware payload delivery URL (confidence level: 100%)
https://cryptoinfa.comUnknown malware payload delivery URL (confidence level: 100%)
https://dmmediacamp.com/Unknown malware payload delivery URL (confidence level: 90%)
https://trd.vn/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.perthspeechpathology.com.au/Unknown malware payload delivery URL (confidence level: 90%)
http://45.144.53.58/949ea21567eb4db7.phpStealc botnet C2 (confidence level: 100%)
https://ggh5e4h54.ccStealc botnet C2 (confidence level: 100%)
https://seiho-ippankatei.com/Unknown malware payload delivery URL (confidence level: 90%)
https://yolwkl.org/captcha.htmlUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 123

47.236.194.231Unknown malware botnet C2 server (confidence level: 100%)
104.168.142.88STRRAT botnet C2 server (confidence level: 100%)
158.94.210.133Latrodectus botnet C2 server (confidence level: 100%)
91.214.78.123Remcos botnet C2 server (confidence level: 100%)
139.59.141.55Unknown malware botnet C2 server (confidence level: 100%)
78.47.226.37Hook botnet C2 server (confidence level: 100%)
197.44.116.226Unknown malware botnet C2 server (confidence level: 100%)
104.198.157.155Meterpreter botnet C2 server (confidence level: 100%)
43.155.252.158Cobalt Strike botnet C2 server (confidence level: 75%)
137.220.194.49Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 1

WORMHOLE payload (confidence level: 50%)

f68872773a88652541bd8d6ca9bda058

Description

ThreatFox IOCs for 2025-11-27

Impact

For European organizations, the impact of this threat intelligence is primarily in the realm of improved detection and response rather than direct compromise. The availability of these IOCs can help security teams identify malicious network activity or payload delivery attempts that align with the reported indicators. This can reduce dwell time of attackers and limit potential damage from malware infections. However, since no specific vulnerabilities or exploits are detailed, there is no immediate risk of exploitation or system compromise. The medium severity rating suggests that while the threat intelligence is useful, it does not indicate a critical or widespread active threat. Organizations with mature security operations centers (SOCs) and threat intelligence capabilities will benefit most by integrating these IOCs into their monitoring tools. Conversely, organizations lacking such capabilities may find limited immediate benefit. The lack of patches or exploit activity means no urgent remediation is required, but vigilance in monitoring is advised. Overall, the impact is moderate and focused on enhancing defensive posture rather than responding to an active attack.

Defensive guidance

To effectively leverage this threat intelligence, European organizations should integrate the provided IOCs into their security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools. Regularly updating threat intelligence feeds and correlating these IOCs with internal logs can improve detection of suspicious network activity and payload delivery attempts. Security teams should conduct threat hunting exercises using these indicators to proactively identify potential compromises. Additionally, organizations should ensure robust network segmentation and implement strict access controls to limit the impact of any detected malware activity. Employee awareness training on phishing and social engineering remains important, as payload delivery often exploits human factors. Since no patches are available, maintaining up-to-date software and applying security best practices reduces the attack surface. Collaboration with national and European cybersecurity agencies can enhance situational awareness and response coordination. Finally, documenting and sharing any findings related to these IOCs within trusted communities can improve collective defense.

Community reviews

Loading reviews…