ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 151.243.150.40:5353.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1821608
IOC: 151.243.150.40:5353
IOC Type :ip:port
Threat Type :botnet_cc
Malware: XMRIG
Confidence Level : Confidence level is high (80%)
Is compromised? : False
ASN:AS209413 DEDIK-CH
First seen:2026-06-03 05:55:08 UTC
Last seen:never
UUID:dbc796fd-5edb-11f1-b930-42010aa4000a
Reporter nullblue67
Reward 5 credits from ThreatFox
Tags:covert-channel DNS-C2 DNS-tunneling docker-api miner port-5353 stealth xmrig
Reference: https://twitter.com/NullBlue67

Avatar
nullblue67
DNS-based C2 channel on port 5353. Bot queries TXT records (dig @151.243.150.40 -p 5353 TXT total +short) to receive commands via DNS. Same operator that dropped XMRig yesterday via Docker API now added DNS-over-port-5353 as covert C2 channel. Sophisticated stealth technique. 2026-06-03 NullBlue67.