ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 206.166.251.123:8591.

Database Entry


IOC ID:1854544
IOC: 206.166.251.123:8591
IOC Type :ip:port
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is elevated (70%)
Is compromised? : True
ASN:AS399629 BLNWX
Country:- NL
First seen:2026-07-21 05:20:20 UTC
Last seen:never
UUID:e7e78397-8480-11f1-8973-42010aa4000a
Reporter DENNISAROSS
Reward 5 credits from ThreatFox
Tags:BL-Networks credential-market darknet Kraken-market Tor-client

Avatar
DENNISAROSS
BL Networks (AS399629) server running a persistent Tor client since 2025, targeting Kraken Russian darknet market (kraken2trfqodidvlh4aa337cpzfrhdlfldhve5nf7njhumwr7instad.onion). cons_dev.txt logs CONSENSUS_ARRIVED events every ~1-2 hrs and CIRCUIT_ESTABLISHED at 16:30 UTC 2026-07-20. Guard nodes use firewall-bypass ports (53, 80). Co-located on same ASN as BlankGrabber staging server (193.149.187.77) and Banana RAT C2 (162.33.178.68) — likely operator market access node for selling harvested credentials. Port 8591 hosts open directory exposing Tor client state files.