🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 149.248.3.38:9960.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1836705
IOC: 149.248.3.38:9960
IOC Type :ip:port
Threat Type :payload_delivery
Malware: Unknown malware
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS20473 AS-VULTR
Country:- US
First seen:2026-06-24 06:36:06 UTC
Last seen:never
UUID:b06b3bac-6f8a-11f1-97fa-42010aa4000a
Reporter Anonymous
Reward 5 credits from ThreatFox
Tags:AcmeCo G1017 Go-TLS JDY payload VoltTyphoon
Reference: https://github.com/yankywilson/jdy-botnet-threat-analysis/tree/main

Avatar
Anonymous
JDY payload host, Acme Co Go-TLS listener (one of 9960-9964), co-resident with Platypus/Termite on 13339. Vultr LA. "Acme Co" is Go's default self-signed test cert and is commodity on its own — significance comes only from the pairing with the Platypus port on the same host. Submitted as payload_delivery for the JDY cluster.