IndicatorPublished 29 Nov 2025Updated 30 Nov 2025

ThreatFox IOCs for 2025-11-29

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 2,156

rasslablen.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
account-extrapulse.cfdUnknown malware payload delivery domain (confidence level: 100%)
account-extranetportal.comUnknown malware payload delivery domain (confidence level: 100%)
ish.co.keUnknown malware payload delivery domain (confidence level: 100%)
kubetting.orgUnknown malware payload delivery domain (confidence level: 100%)
api.equisphire.comUnknown malware payload delivery domain (confidence level: 100%)
sessionsverificates.liveUnknown malware payload delivery domain (confidence level: 100%)
btexe3dc53f6dc453f6a9f461a5h.pages.devUnknown malware payload delivery domain (confidence level: 100%)
cdn.rs-dns.sbsUnknown malware botnet C2 domain (confidence level: 100%)
ln.esca1t3ust.ruClearFake payload delivery domain (confidence level: 100%)

URLs 92

https://boriver.com/mnb/plr.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://rasslablen.com/mnb/ooo.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://account-extrapulse.cfdUnknown malware payload delivery URL (confidence level: 100%)
https://lospls.com/j.txtUnknown malware payload delivery URL (confidence level: 100%)
https://account-extranetportal.comUnknown malware payload delivery URL (confidence level: 100%)
https://kubetting.orgUnknown malware payload delivery URL (confidence level: 100%)
https://api.equisphire.comUnknown malware payload delivery URL (confidence level: 100%)
https://sessionsverificates.liveUnknown malware payload delivery URL (confidence level: 100%)
http://78.40.209.3:5506/sd.vbsUnknown malware payload delivery URL (confidence level: 100%)
https://btexe3dc53f6dc453f6a9f461a5h.pages.devUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 212

213.209.143.34Mirai botnet C2 server (confidence level: 100%)
93.88.204.87Mirai botnet C2 server (confidence level: 80%)
151.245.104.90Mirai botnet C2 server (confidence level: 80%)
176.97.124.206Mirai botnet C2 server (confidence level: 80%)
95.119.157.140Unknown malware botnet C2 server (confidence level: 100%)
165.101.92.54DCRat botnet C2 server (confidence level: 100%)
43.167.236.116Unknown malware botnet C2 server (confidence level: 100%)
20.78.34.24Unknown malware botnet C2 server (confidence level: 100%)
157.245.130.157Unknown malware botnet C2 server (confidence level: 100%)
47.100.117.59Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-11-29

Impact

For European organizations, the impact of this threat is primarily in the domain of threat detection and preparedness rather than direct compromise. Since no active exploits or affected software versions are identified, the immediate risk of data breach, system integrity loss, or service disruption is low. However, failure to incorporate these IOCs into security monitoring could result in delayed detection of malware campaigns that utilize similar indicators. Organizations with extensive network infrastructure and reliance on OSINT for threat hunting may find this intelligence valuable for early warning. The medium severity suggests moderate potential for payload delivery and network-based attacks if threat actors operationalize these IOCs. Consequently, the impact is more strategic, enhancing defensive posture rather than mitigating an ongoing attack. European entities in critical infrastructure, finance, and government sectors should consider this intelligence to maintain situational awareness and improve incident response capabilities.

Defensive guidance

1. Integrate the provided ThreatFox IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection capabilities. 2. Conduct regular threat hunting exercises using these IOCs to identify potential early-stage malware activity within networks. 3. Update firewall and intrusion detection/prevention system (IDS/IPS) rules to monitor for network activity patterns associated with the IOCs. 4. Train security analysts to recognize OSINT-related threat patterns and payload delivery mechanisms indicated by the feed. 5. Maintain up-to-date asset inventories to quickly correlate IOC matches with critical systems. 6. Collaborate with national Computer Emergency Response Teams (CERTs) and information sharing groups to contextualize these IOCs within broader threat landscapes. 7. Since no patches are available, focus on detection and containment strategies rather than remediation. 8. Implement network segmentation and strict access controls to limit potential malware propagation if these IOCs are linked to active campaigns. 9. Continuously monitor ThreatFox and similar OSINT feeds for updates or changes in threat status. 10. Conduct simulated phishing and malware delivery exercises to test organizational resilience against payload delivery threats.

Community reviews

Loading reviews…