IndicatorPublished 22 Dec 2025Updated 23 Dec 2025

ThreatFox IOCs for 2025-12-22

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 201

21food.cn.comAsyncRAT botnet C2 domain (confidence level: 100%)
mingxing.cn.comAsyncRAT botnet C2 domain (confidence level: 100%)
chis.cn.comAsyncRAT botnet C2 domain (confidence level: 100%)
iciba.cn.comAsyncRAT botnet C2 domain (confidence level: 100%)
bot.doball99.liveUnknown malware botnet C2 domain (confidence level: 100%)
retoinnovacion.xyzHook botnet C2 domain (confidence level: 100%)
ub.testingweblink.comHavoc botnet C2 domain (confidence level: 100%)
tyrwam.stumbv1gil2nt.ruClearFake payload delivery domain (confidence level: 100%)
fvgqer.nep2le5reach.ruClearFake payload delivery domain (confidence level: 100%)
yxmdeq.nep2le5reach.ruClearFake payload delivery domain (confidence level: 100%)

URLs 10

https://wootest.lifos.com.tr/Unknown malware payload delivery URL (confidence level: 90%)
http://124.222.182.210:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://103.43.71.150:5858/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://alphamservice.be/Unknown malware payload delivery URL (confidence level: 90%)
https://kilab-gaming.github.io/captcha-verify/Unknown malware payload delivery URL (confidence level: 90%)
https://86.54.42.15/Vidar botnet C2 (confidence level: 100%)
http://80.97.160.144Stealc botnet C2 (confidence level: 100%)
http://37.221.66.166Stealc botnet C2 (confidence level: 100%)
http://bobrecurwarmumsworms.com:8080/updater?for=0ed06aea39d382d8719612624077c3c1Unknown malware botnet C2 (confidence level: 100%)
http://107.189.20.142/cafc9966dc4c4240.phpStealc botnet C2 (confidence level: 100%)

IP addresses 116

84.252.120.207Mirai botnet C2 server (confidence level: 80%)
41.216.189.188Mirai botnet C2 server (confidence level: 80%)
103.43.71.150Unknown malware botnet C2 server (confidence level: 100%)
134.122.154.44Unknown malware botnet C2 server (confidence level: 100%)
38.12.32.107Unknown malware botnet C2 server (confidence level: 100%)
68.168.218.88Unknown malware botnet C2 server (confidence level: 100%)
141.253.116.166Unknown malware botnet C2 server (confidence level: 100%)
173.212.229.99Unknown malware botnet C2 server (confidence level: 100%)
47.236.202.114Unknown malware botnet C2 server (confidence level: 100%)
155.133.22.95Unknown malware botnet C2 server (confidence level: 100%)

Hashes 13

a358dd8396e7295802ec04af1bec043f4f48e6db475c0ff25a7dc1f18bdd7624Unknown malware payload (confidence level: 100%)
2ca07f0b2cb05017e5c30caafb4f02cfe980bd74f97a08650a82848993e7acd8Unknown malware payload (confidence level: 100%)
1e8db0c9bb6867c0eb550687a3e58cdf9337996149d83a3ca138d1ebb53df214Unknown malware payload (confidence level: 100%)
8f79af2a36683b9756c2858bd386f3f392f261a187aaa524ab4fce2dc0a11b69Unknown malware payload (confidence level: 100%)
2275f4f330d2d5299d4b83dbd972e7cd0f6183fc75b82c86b5ef601e81eb471fUnknown malware payload (confidence level: 100%)
0e164581679e59b6ae9daf224051ed5215664a9708bd0855b731c5ef53369836Unknown malware payload (confidence level: 100%)
8953b1bc8a79db168f9262d573b8245e0762c8fbf91386a01b45bc5dfab753feUnknown malware payload (confidence level: 100%)
62d914e7943ab86399586ab99ce408e025117d4995f026e4ba40eb3791baaec3Unknown Stealer payload (confidence level: 100%)
6754d5db1741f87d302d60101033d3b37aa29ac40a05551e86f81c00e41cc523Unknown Stealer payload (confidence level: 100%)
a6f458a42d0b5e7f9d4285f0a95b77bef05458d254b20698622ee6df4415f35aUnknown Stealer payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-12-22

Impact

Given the lack of specific affected products, versions, or exploit details, the direct impact of this threat on European organizations is limited. However, as a source of OSINT related to network activity and payload delivery, it can help organizations detect and respond to potential malicious activities early. European organizations that rely on threat intelligence feeds like ThreatFox can benefit from incorporating these IOCs into their detection systems to enhance situational awareness. The medium severity rating suggests that while the threat is not critical, ignoring such intelligence could allow attackers to leverage payload delivery techniques unnoticed. The absence of known exploits in the wild reduces immediate risk, but the potential for future exploitation exists if attackers adopt these payloads or tactics. Therefore, the impact is primarily on the ability to detect and respond to evolving threats rather than direct compromise or disruption.

Defensive guidance

To effectively leverage this threat intelligence, European organizations should integrate ThreatFox IOCs into their Security Information and Event Management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enhance detection capabilities. Regularly updating threat intelligence feeds and correlating them with internal logs can help identify suspicious network activity or payload delivery attempts. Organizations should also conduct network traffic analysis focusing on anomalies that match the patterns described in the feed. Since no patches or fixes are available, emphasis should be placed on proactive monitoring, incident response readiness, and user awareness training to recognize potential payload delivery mechanisms. Additionally, sharing relevant findings with local Computer Security Incident Response Teams (CSIRTs) can improve collective defense. Tailoring detection rules to the specific network environment and validating alerts to reduce false positives will improve operational efficiency.

Community reviews

Loading reviews…