ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 64.52.80.235:80.

Database Entry


IOC ID:1854547
IOC: 64.52.80.235:80
IOC Type :ip:port
Threat Type :payload_delivery
Malware: Unknown malware
Confidence Level : Confidence level is elevated (70%)
Is compromised? : True
ASN:AS399629 BLNWX
Country:- NL
First seen:2026-07-21 05:20:17 UTC
Last seen:never
UUID:e4096d5c-8483-11f1-8973-42010aa4000a
Reporter DENNISAROSS
Reward 5 credits from ThreatFox
Tags:BL-Networks cross-platform homebrew-lure jar java payload-delivery

Avatar
DENNISAROSS
Java malware (JAR) staging server on BL Networks (AS399629). Open directory at http://64.52.80.235/ hosting 4x ~706K Java JAR payloads (Bubawo, Gewijenil, Nufuderi, homebrew) paired with 4x ~100-114 byte shell script droppers (Gesajole, Jalifume, Rojevuwi, Meyugego). Files added incrementally July 10-15 2026. 'homebrew' filename targets macOS users. Associated domain: hometwfrbas.com. Same BL Networks cluster as BlankGrabber (193.149.187.77) and Banana RAT (162.33.178.68). JAR family pending hash analysis — likely Adwind/jRAT or AllaKore.