IndicatorPublished 31 Dec 2025Updated 1 Jan 2026

ThreatFox IOCs for 2025-12-31

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 74

www.dgccollectors.comGootLoader botnet C2 domain (confidence level: 100%)
www.walkingholidays.co.zaGootLoader botnet C2 domain (confidence level: 100%)
youngtechcoorp.comGootLoader botnet C2 domain (confidence level: 100%)
www.criticalcare-neurotrauma.caGootLoader botnet C2 domain (confidence level: 100%)
www.dancesportacademy.nlGootLoader botnet C2 domain (confidence level: 100%)
999slot.mediaAsyncRAT botnet C2 domain (confidence level: 100%)
h11uu.comQuasar RAT botnet C2 domain (confidence level: 100%)
veredictum.in.netAsyncRAT botnet C2 domain (confidence level: 100%)
www.aicinformatique.comGootLoader botnet C2 domain (confidence level: 100%)
www.fahrschule-br.deGootLoader botnet C2 domain (confidence level: 100%)

URLs 28

http://158.94.210.60:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://5.35.124.133/Unknown malware payload delivery URL (confidence level: 90%)
https://216.92.60.125/Unknown malware payload delivery URL (confidence level: 90%)
https://5.161.254.141/Unknown malware payload delivery URL (confidence level: 90%)
https://103.241.42.40/Unknown malware payload delivery URL (confidence level: 90%)
https://4.227.186.5/Unknown malware payload delivery URL (confidence level: 90%)
https://92.205.227.106/Unknown malware payload delivery URL (confidence level: 90%)
https://13.58.180.189/Unknown malware payload delivery URL (confidence level: 90%)
https://ekoplod.pentasoftcomputers.eu/Unknown malware payload delivery URL (confidence level: 90%)
https://18.233.234.27/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 131

158.94.210.60Unknown malware botnet C2 server (confidence level: 100%)
184.154.75.10Unknown malware botnet C2 server (confidence level: 100%)
185.126.67.49Unknown malware botnet C2 server (confidence level: 100%)
121.56.26.2QakBot botnet C2 server (confidence level: 75%)
113.30.152.32Sliver botnet C2 server (confidence level: 100%)
167.86.145.216NetSupportManager RAT botnet C2 server (confidence level: 100%)
185.115.34.131XWorm botnet C2 server (confidence level: 100%)
65.87.7.173AdaptixC2 botnet C2 server (confidence level: 100%)
54.226.51.148Meterpreter botnet C2 server (confidence level: 100%)
54.226.51.148Meterpreter botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-12-31

Impact

For European organizations, the impact of this threat is primarily in the domain of situational awareness and threat detection rather than direct compromise. Since no active exploits or vulnerabilities are identified, the immediate risk to confidentiality, integrity, or availability is low. However, failure to incorporate these IOCs into security monitoring tools could reduce the effectiveness of detecting malware-related network activity or payload delivery attempts. Organizations heavily reliant on OSINT feeds for threat intelligence will benefit from integrating this data to improve early warning capabilities. The medium severity suggests a moderate potential for detection improvement but not a direct operational threat. The lack of patches or exploit evidence means no urgent operational changes are needed, but ongoing vigilance is recommended. European entities with critical infrastructure or high-value targets should maintain updated threat intelligence feeds to anticipate and mitigate potential malware campaigns that might leverage these indicators in the future.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection of related network activity and payload delivery attempts. 2. Regularly update threat intelligence feeds, including ThreatFox and other OSINT sources, to maintain current situational awareness. 3. Conduct proactive threat hunting exercises using these IOCs to identify any early signs of compromise or suspicious activity within the network. 4. Ensure endpoint detection and response (EDR) tools are configured to recognize and alert on behaviors associated with the indicators. 5. Train security analysts to understand the context and limitations of OSINT-based IOCs to avoid false positives and focus on actionable intelligence. 6. Maintain robust network segmentation and monitoring to limit the impact of any malware payload delivery that might be detected through these indicators. 7. Collaborate with national and European cybersecurity centers to share intelligence and validate the relevance of these IOCs in local contexts.

Community reviews

Loading reviews…