IndicatorPublished 25 Dec 2025Updated 26 Dec 2025

ThreatFox IOCs for 2025-12-25

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 314

aacobson.comKongTuke payload delivery domain (confidence level: 100%)
dit.kievholod.kiev.uaVidar botnet C2 domain (confidence level: 100%)
aa888.br.comAsyncRAT botnet C2 domain (confidence level: 50%)
premierservices365.comUnknown Stealer botnet C2 domain (confidence level: 100%)
kyalli3.testingweblink.comHavoc botnet C2 domain (confidence level: 100%)
messagepathconfirmation.downloadUnknown malware botnet C2 domain (confidence level: 100%)
bandizip.bandUnknown malware botnet C2 domain (confidence level: 75%)
capframex.orgUnknown malware botnet C2 domain (confidence level: 75%)
easeus.techUnknown malware botnet C2 domain (confidence level: 75%)
ksdbmerge.comUnknown malware botnet C2 domain (confidence level: 75%)

URLs 10

https://aacobson.com/3w3w.jsKongTuke payload delivery URL (confidence level: 100%)
https://aacobson.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
https://193.233.198.6/Vidar botnet C2 (confidence level: 100%)
https://garnevf.cyou/apiLumma Stealer botnet C2 (confidence level: 100%)
http://svclsc.com/ms/index.phpAmadey botnet C2 (confidence level: 100%)
http://62.60.226.159/geter/index.phpUnknown Stealer botnet C2 (confidence level: 100%)
http://95.164.123.123Stealc botnet C2 (confidence level: 100%)
http://77.110.123.23/ce369e7324834845.phpStealc botnet C2 (confidence level: 100%)
http://145.249.109.155/bullnecked.phpAMOS botnet C2 (confidence level: 100%)
https://145.249.109.155/bullnecked.phpAMOS botnet C2 (confidence level: 100%)

IP addresses 151

176.65.132.233Mirai botnet C2 server (confidence level: 80%)
139.196.223.82Cobalt Strike botnet C2 server (confidence level: 100%)
176.188.139.132Cobalt Strike botnet C2 server (confidence level: 100%)
137.220.223.158Ghost RAT botnet C2 server (confidence level: 75%)
13.61.25.218Unknown malware botnet C2 server (confidence level: 100%)
217.71.203.187Unknown malware botnet C2 server (confidence level: 100%)
164.92.71.38Unknown malware botnet C2 server (confidence level: 100%)
198.13.47.54Unknown malware botnet C2 server (confidence level: 100%)
51.91.253.110Unknown malware botnet C2 server (confidence level: 100%)
51.91.253.110Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-12-25

Impact

For European organizations, the impact of this ThreatFox IOC feed entry is primarily in enhancing threat detection and situational awareness rather than responding to an active or critical threat. The medium severity suggests that while the indicators may help identify malicious payload delivery attempts or network activity, there is no direct evidence of exploitation or compromise. Organizations relying on threat intelligence feeds can use this data to improve their detection capabilities, potentially preventing malware infections or network intrusions. However, since no specific vulnerabilities or exploits are detailed, the immediate risk to confidentiality, integrity, or availability is limited. The impact is therefore more strategic, supporting incident response and threat hunting efforts rather than requiring urgent patching or remediation. European entities with mature security operations centers (SOCs) and threat intelligence teams will benefit most from integrating this information. Conversely, organizations without such capabilities may find limited direct impact. Overall, the threat intelligence contributes to a layered defense posture but does not represent a direct operational threat at this time.

Defensive guidance

1. Integrate ThreatFox IOC feeds and similar OSINT sources into Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection of suspicious payload delivery and network activity. 2. Regularly update detection rules and signatures based on the latest threat intelligence to identify emerging malware indicators. 3. Conduct proactive threat hunting exercises using the provided IOCs to identify potential compromises early. 4. Ensure network segmentation and strict monitoring of inbound and outbound traffic to detect anomalous payload delivery attempts. 5. Train security analysts to contextualize OSINT data and correlate it with internal logs for effective incident response. 6. Maintain up-to-date asset inventories and vulnerability management programs to reduce attack surface, even though no patches are currently available for this specific threat. 7. Collaborate with European cybersecurity information sharing organizations to validate and enrich threat intelligence. 8. Avoid reliance on this IOC feed alone; use it as part of a comprehensive threat intelligence strategy that includes multiple sources and active monitoring.

Summary

The data provided describes a ThreatFox IOC feed entry dated December 25, 2025, categorized under malware with emphasis on OSINT (Open Source Intelligence), payload delivery, and network activity. ThreatFox is a platform that aggregates and shares Indicators of Compromise to aid cybersecurity professionals in detecting and mitigating threats. This entry does not specify any particular malware variant, affected software versions, or vulnerabilities but rather represents a set of threat intelligence indicators intended for situational awareness and detection. The absence of known exploits in the wild and lack of patch availability suggest that this is not an active zero-day or critical vulnerability but rather intelligence on potential or emerging threats. The threat level and analysis scores are low to moderate, indicating limited immediate risk but relevance for monitoring. The data lacks concrete technical details such as specific attack vectors, payload characteristics, or exploitation methods. As such, it is primarily useful for security teams to update detection rules, monitor network traffic for suspicious activity, and enhance their OSINT capabilities. The medium severity rating reflects the potential for these indicators to assist in identifying malicious activity but does not indicate an imminent or widespread threat. This type of intelligence is valuable for proactive defense but requires contextualization with other threat data to assess real risk.

Community reviews

Loading reviews…