IndicatorPublished 21 Dec 2025Updated 22 Dec 2025

ThreatFox IOCs for 2025-12-21

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 181

koz1.in.netAsyncRAT botnet C2 domain (confidence level: 100%)
convergepay.co.comUnknown malware botnet C2 domain (confidence level: 75%)
southstateonline.co.comUnknown malware botnet C2 domain (confidence level: 75%)
saferpay.co.comUnknown malware botnet C2 domain (confidence level: 75%)
spendesk.co.comUnknown malware botnet C2 domain (confidence level: 75%)
carterfcu.co.comUnknown malware botnet C2 domain (confidence level: 75%)
flagstarbank.co.comUnknown malware botnet C2 domain (confidence level: 75%)
tivimate.co.comUnknown malware botnet C2 domain (confidence level: 75%)
app-slash.co.comUnknown malware botnet C2 domain (confidence level: 75%)
fleetone.co.comUnknown malware botnet C2 domain (confidence level: 75%)

URLs 9

http://160.250.132.50/ohshit.shUnknown malware payload delivery URL (confidence level: 75%)
http://43.103.44.66:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://verify-captcha.sbs:3000/Unknown malware botnet C2 (confidence level: 100%)
http://www.msk-captcha.cfd:3000/Unknown malware botnet C2 (confidence level: 100%)
http://38.148.242.220:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://newapi-ffxg.onrender.com/api/sendUnknown Stealer botnet C2 (confidence level: 100%)
http://taymurazwarclavow.space:8080/updater?for=e57cbc8db3cd6dfc22897bc02fee13d8Unknown malware botnet C2 (confidence level: 100%)
http://62.60.226.159/xopbixc/data.phpUnknown Stealer botnet C2 (confidence level: 100%)
http://62.60.178.9/ce369e7324834845.phpStealc botnet C2 (confidence level: 100%)

IP addresses 83

45.93.20.134Stealc botnet C2 server (confidence level: 100%)
191.96.78.196Remcos botnet C2 server (confidence level: 100%)
110.172.104.140Remcos botnet C2 server (confidence level: 100%)
202.155.11.205Unknown malware botnet C2 server (confidence level: 100%)
91.108.27.135Quasar RAT botnet C2 server (confidence level: 100%)
102.98.77.193NetSupportManager RAT botnet C2 server (confidence level: 100%)
140.99.83.234Bashlite botnet C2 server (confidence level: 100%)
85.9.202.108MimiKatz botnet C2 server (confidence level: 100%)
139.199.160.80AdaptixC2 botnet C2 server (confidence level: 100%)
123.156.62.67Meterpreter botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-12-21

Impact

For European organizations, the impact of this threat is currently limited due to the lack of specific exploit details or active attacks. The primary risk lies in potential reconnaissance and information gathering activities that could precede more targeted malware campaigns. Organizations relying heavily on OSINT tools or those with critical infrastructure that could be targeted by payload delivery mechanisms should be aware of these IOCs to enhance their detection capabilities. If these IOCs are integrated into threat detection systems, they can improve early warning and incident response. However, without active exploitation or known vulnerabilities, the immediate operational impact remains low to moderate. The threat could serve as a precursor to more sophisticated attacks, so maintaining situational awareness and readiness is important. Overall, the impact is primarily on the confidentiality and integrity of information if reconnaissance leads to successful payload delivery in the future.

Defensive guidance

European organizations should incorporate the provided IOCs into their existing security monitoring and threat intelligence platforms to enhance detection of related network activity. Strengthening OSINT capabilities and ensuring continuous monitoring of network traffic for unusual payload delivery attempts can help identify early signs of compromise. Organizations should also conduct regular threat hunting exercises using these IOCs to proactively detect potential intrusions. Updating firewall and intrusion detection/prevention system (IDS/IPS) rules to flag suspicious network behaviors associated with these indicators is recommended. Since no patches or direct exploits are identified, focus should be on improving visibility and response readiness rather than patch management. Collaboration with national cybersecurity centers and sharing intelligence within trusted communities can improve collective defense. Training security analysts to recognize patterns related to OSINT-driven reconnaissance and payload delivery tactics will further enhance mitigation efforts.

Community reviews

Loading reviews…