IndicatorPublished 13 Dec 2025Updated 14 Dec 2025

ThreatFox IOCs for 2025-12-13

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 175

ace-batiment.comUnknown Stealer payload delivery domain (confidence level: 100%)
ity.keyzsoft.comVidar botnet C2 domain (confidence level: 100%)
renviox.comUnknown malware payload delivery domain (confidence level: 100%)
instance-p3rfvx-relay.screenconnect.comUnknown RAT botnet C2 domain (confidence level: 100%)
effinghampodiatriclore.comUnknown Stealer botnet C2 domain (confidence level: 100%)
light.neur0l5uptn.ruClearFake payload delivery domain (confidence level: 100%)
bridge.neur0l5uptn.ruClearFake payload delivery domain (confidence level: 100%)
z6.neur0l5uptn.ruClearFake payload delivery domain (confidence level: 100%)
shadow.champm2loma1.ruClearFake payload delivery domain (confidence level: 100%)
ocean.champm2loma1.ruClearFake payload delivery domain (confidence level: 100%)

URLs 11

http://91.92.243.254/kelly/five/pvqdq929bsx_a_d_m1n_a.phpLokiBot botnet C2 (confidence level: 100%)
https://193.233.126.16/Vidar botnet C2 (confidence level: 100%)
http://69.5.189.119/ca181e88d271449b.phpStealc botnet C2 (confidence level: 100%)
http://23.95.148.136:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://77.110.114.11/ce369e7324834845.phpStealc botnet C2 (confidence level: 100%)
http://77.105.161.133/1ea995999d91ca21.phpStealc botnet C2 (confidence level: 100%)
https://ace-batiment.com/Unknown malware payload delivery URL (confidence level: 90%)
https://travellerschoice.ae/Unknown malware payload delivery URL (confidence level: 90%)
http://107.174.115.101:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://jqueryapihelpers.com/zrk5hzrslw1-tky60uruimaklj1zqfozs9hizwdppcbFAKEUPDATES payload delivery URL (confidence level: 100%)

IP addresses 397

193.233.126.16Vidar botnet C2 server (confidence level: 100%)
69.5.189.119Stealc botnet C2 server (confidence level: 100%)
77.105.161.133Stealc botnet C2 server (confidence level: 100%)
80.64.19.148XWorm botnet C2 server (confidence level: 100%)
39.86.248.188Loki Password Stealer (PWS) botnet C2 server (confidence level: 75%)
77.110.114.11Stealc botnet C2 server (confidence level: 100%)
3.226.247.149MimiKatz botnet C2 server (confidence level: 100%)
103.231.174.35AdaptixC2 botnet C2 server (confidence level: 100%)
54.145.191.161Meterpreter botnet C2 server (confidence level: 100%)
72.62.60.228Empire Downloader botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-12-13

Impact

Given the lack of specific exploit details, affected products, or active exploitation, the immediate impact on European organizations is likely low to medium. The threat relates to malware delivery and network activity, which could potentially lead to data exfiltration, system compromise, or disruption if exploited. However, without concrete indicators or known exploits, the risk remains largely theoretical. Organizations relying on OSINT feeds and threat intelligence platforms may benefit from integrating these IOCs to enhance detection capabilities. The potential impact includes increased monitoring overhead and the need to validate and triage alerts generated from these IOCs. If the malware payloads referenced were to be weaponized in the future, the impact could escalate, particularly for sectors with high-value data or critical infrastructure. Currently, the threat does not indicate targeted attacks or specific vulnerabilities that would disproportionately affect European entities.

Defensive guidance

1. Integrate ThreatFox IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection of related malware activity. 2. Maintain up-to-date network monitoring and anomaly detection to identify unusual payload delivery or network behavior. 3. Conduct regular threat intelligence reviews to contextualize OSINT-derived indicators and prioritize response efforts. 4. Strengthen email and web gateway defenses to reduce the risk of malware payload delivery via common vectors. 5. Implement strict network segmentation and least privilege access controls to limit potential lateral movement if a compromise occurs. 6. Train security analysts to differentiate between OSINT feed noise and actionable threats to optimize resource allocation. 7. Continuously update incident response plans to incorporate emerging intelligence from feeds like ThreatFox. 8. Collaborate with national and European cybersecurity centers to share intelligence and best practices related to OSINT-derived threats.

Community reviews

Loading reviews…