ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 2.26.133.156:3001.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1848215
IOC: 2.26.133.156:3001
IOC Type :ip:port
Threat Type :botnet_cc
Malware: Unknown Webinject
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS50053 ANTON-LEVIN-AS
Country:- GE
First seen:2026-07-11 05:29:55 UTC
Last seen:never
UUID:51d194df-7c7c-11f1-97fa-42010aa4000a
Reporter Anonymous
Reward 5 credits from ThreatFox
Tags:blockchain-C2 CastleRAT etherhiding EtherRat tsundere
Reference: https://github.com/yankywilson/tsundere-blockchain-c2

Avatar
Anonymous
EtherHiding blockchain-C2 family. These IPs are C2/staging endpoints written on-chain by Ethereum resolver contracts (StringChanged topic0 0x3ca6280d...). ws://:3001 = Tsundere leg (Iran-nexus, likely); :9999 = CastleRAT binary C2 (packet-confirmed). Full intel, IOCs, and YARA/Sigma/Suricata/Zeek rules: https://github.com/yankywilson/tsundere-blockchain-c2