IndicatorPublished 29 Dec 2025Updated 30 Dec 2025

ThreatFox IOCs for 2025-12-29

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 201

mosmet.ru.comAsyncRAT botnet C2 domain (confidence level: 50%)
fitspresso.co.comAsyncRAT botnet C2 domain (confidence level: 50%)
356gfbo3to.gb.netAsyncRAT botnet C2 domain (confidence level: 100%)
name.sa.comDCRat botnet C2 domain (confidence level: 100%)
nationalwaste.uk.comAsyncRAT botnet C2 domain (confidence level: 100%)
9850.cn.comAsyncRAT botnet C2 domain (confidence level: 100%)
44471.jp.netAsyncRAT botnet C2 domain (confidence level: 100%)
login.44471.jp.netAsyncRAT botnet C2 domain (confidence level: 100%)
hhu.uk.comQuasar RAT botnet C2 domain (confidence level: 100%)
mjo.uk.comQuasar RAT botnet C2 domain (confidence level: 100%)

URLs 33

http://91.215.85.42:3003/loginUnknown malware botnet C2 (confidence level: 100%)
https://41.216.188.41/loginUnknown malware botnet C2 (confidence level: 100%)
https://20.92.160.27/Unknown malware payload delivery URL (confidence level: 90%)
https://54.197.245.249/Unknown malware payload delivery URL (confidence level: 90%)
https://216.172.170.236/Unknown malware payload delivery URL (confidence level: 90%)
https://173.254.106.143/Unknown malware payload delivery URL (confidence level: 90%)
https://172.191.195.85/Unknown malware payload delivery URL (confidence level: 90%)
http://130.12.180.20:36695/cat.shUnknown malware payload delivery URL (confidence level: 75%)
https://phrupmv.su/vkdLumma Stealer botnet C2 (confidence level: 75%)
https://sinitjq.cyou/apiLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 118

45.145.42.226Unknown malware botnet C2 server (confidence level: 100%)
134.209.96.175Mirai botnet C2 server (confidence level: 80%)
77.110.114.203Stealc botnet C2 server (confidence level: 100%)
154.193.216.54Cobalt Strike botnet C2 server (confidence level: 100%)
216.126.227.58Sliver botnet C2 server (confidence level: 90%)
154.53.35.211AsyncRAT botnet C2 server (confidence level: 100%)
45.76.44.47Unknown malware botnet C2 server (confidence level: 100%)
34.180.25.91Unknown malware botnet C2 server (confidence level: 100%)
193.29.13.89Unknown malware botnet C2 server (confidence level: 100%)
62.60.176.108Hook botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-12-29

Impact

For European organizations, the impact of this threat is currently uncertain due to the lack of specific exploitation details or targeted products. However, the categorization under payload delivery and network activity suggests potential risks including unauthorized access, data exfiltration, or disruption if the payloads are successfully delivered. Organizations with extensive network infrastructure or those relying on OSINT for threat detection may face increased reconnaissance activity, which could precede more targeted attacks. The medium severity indicates that while immediate critical impact is unlikely, the threat could evolve, necessitating vigilance. Potential impacts include temporary service disruption, compromise of sensitive information, or foothold establishment by threat actors. The absence of known exploits in the wild reduces immediate risk but does not eliminate the possibility of future exploitation. European entities involved in critical infrastructure, finance, or government sectors should be particularly attentive given their strategic importance and attractiveness to threat actors.

Defensive guidance

Given the limited technical details and absence of patches, mitigation should focus on proactive detection and response strategies. Organizations should enhance network traffic monitoring to identify unusual patterns indicative of payload delivery attempts or reconnaissance activities. Integration of ThreatFox and other OSINT feeds into Security Information and Event Management (SIEM) systems can improve early detection of emerging IOCs. Regularly updating and tuning intrusion detection/prevention systems (IDS/IPS) to recognize new threat signatures is essential. Conducting threat hunting exercises focused on network anomalies and suspicious payloads can help identify potential compromises early. Employee awareness training on phishing and social engineering remains critical to prevent initial infection vectors. Network segmentation and strict access controls can limit lateral movement if payloads are delivered. Finally, maintaining robust incident response plans ensures rapid containment and remediation if an infection occurs.

Community reviews

Loading reviews…