IndicatorPublished 10 Dec 2025Updated 11 Dec 2025

ThreatFox IOCs for 2025-12-10

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 334

possibleresc.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
api-logs-b794.onrender.comUnknown Stealer botnet C2 domain (confidence level: 100%)
duedilligence.com.auUnknown malware botnet C2 domain (confidence level: 100%)
ifg.testingweblink.comHavoc botnet C2 domain (confidence level: 100%)
analytics.sentihey.dedyn.ioHavoc botnet C2 domain (confidence level: 100%)
infozzle.testingweblink.comHavoc botnet C2 domain (confidence level: 100%)
myaccount.sentihey.dedyn.ioHavoc botnet C2 domain (confidence level: 100%)
bit.twirl-pane.ruClearFake payload delivery domain (confidence level: 100%)
pixel.twirl-pane.ruClearFake payload delivery domain (confidence level: 100%)
weird.twirl-pane.ruClearFake payload delivery domain (confidence level: 100%)

URLs 35

https://watchsmiler.com/clipper/lolipop.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://possibleresc.com/lol.pdfNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://rewardsplus.phm-hotels.com/Unknown malware payload delivery URL (confidence level: 90%)
http://193.24.123.68:3001/gfdsgsdfhfsd_ghsfdgsfdgsdfg.shUnknown malware payload delivery URL (confidence level: 100%)
https://api-logs-b794.onrender.com/api/sendUnknown Stealer botnet C2 (confidence level: 100%)
https://api-logs-b794.onrender.com/api/dcinjection-sendUnknown Stealer botnet C2 (confidence level: 100%)
https://xydizainten.org/yckojlmxiwczfss//comrcvpefffipvf.phpUnknown Stealer botnet C2 (confidence level: 100%)
http://194.33.61.95Stealc botnet C2 (confidence level: 100%)
http://95.182.101.109Stealc botnet C2 (confidence level: 100%)
https://www.mn.baykarmobilya.com/Unknown malware botnet C2 (confidence level: 50%)

IP addresses 137

91.92.240.18Stealc botnet C2 server (confidence level: 100%)
95.153.32.247Stealc botnet C2 server (confidence level: 100%)
85.158.111.53NetSupportManager RAT payload delivery server (confidence level: 100%)
193.24.123.68Unknown malware botnet C2 server (confidence level: 75%)
91.215.85.42Unknown malware payload delivery server (confidence level: 75%)
154.201.68.228Cobalt Strike botnet C2 server (confidence level: 100%)
154.21.202.124Cobalt Strike botnet C2 server (confidence level: 100%)
143.92.62.76Unknown malware botnet C2 server (confidence level: 100%)
45.148.8.121Unknown malware botnet C2 server (confidence level: 100%)
38.55.106.47Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-12-10

Impact

For European organizations, the impact of this threat is moderate. Since no specific software or hardware vulnerabilities are identified, the threat primarily concerns the potential for malware payload delivery via network activity. This could lead to unauthorized access, data exfiltration, or disruption of services if payloads are successfully delivered and executed. The medium severity suggests that while the threat is not critical, it could still affect confidentiality and availability if defenses are insufficient. Organizations relying heavily on networked systems and those with extensive external connectivity may be more exposed. The lack of known exploits in the wild reduces immediate risk, but the presence of IOCs indicates ongoing monitoring and potential for future exploitation. European entities with mature cybersecurity frameworks can leverage this intelligence to enhance detection and response, minimizing potential damage. However, less prepared organizations might face challenges in identifying and mitigating such threats promptly. The threat's OSINT nature underscores the importance of integrating open-source intelligence into security operations to anticipate and counter emerging malware delivery tactics.

Defensive guidance

European organizations should implement several specific measures to mitigate this threat effectively: 1) Integrate the provided ThreatFox IOCs into existing Security Information and Event Management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enhance detection of related network activity and payload delivery attempts. 2) Conduct regular network traffic analysis focusing on unusual or suspicious payload delivery patterns, leveraging behavioral analytics and anomaly detection tools. 3) Strengthen email and web gateway defenses to filter and block potential malware delivery vectors, including advanced sandboxing and URL reputation checks. 4) Maintain up-to-date threat intelligence feeds and ensure security teams are trained to interpret and act on OSINT data promptly. 5) Implement network segmentation to limit lateral movement in case of successful payload execution. 6) Employ endpoint detection and response (EDR) solutions capable of identifying and containing malware payloads early. 7) Conduct regular security awareness training emphasizing the risks of payload delivery mechanisms such as phishing. 8) Collaborate with national and European cybersecurity centers to share intelligence and receive timely alerts about emerging threats. These targeted actions go beyond generic advice by focusing on leveraging OSINT IOCs, enhancing network-level defenses, and fostering information sharing.

Community reviews

Loading reviews…