ThreatFox IOC Database

You are viewing the ThreatFox database entry for url http://94.26.106.195:5555.

Database Entry


IOC ID:1868137
IOC: http://94.26.106.195:5555
IOC Type :url
Threat Type :botnet_cc
Malware: xmrig
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS197170 TECHTIES-AS
Country:- DE
First seen:2026-08-04 07:32:11 UTC
Last seen:never
UUID:5233fede-8fd2-11f1-8325-42010aa4000a
Reporter nwicks
Reward 5 credits from ThreatFox
Tags:cryptojacking proxyjacking traffmonetizer xmrig
Reference: https://nehemiyawicks.github.io/research

Avatar
nwicks
Primary C2 and Stratum proxy for Romanian-speaking XMRig+Traffmonetizer campaign targeting Oracle Cloud aarch64 instances via code-server brute force. First publication. Full writeup with IOCs, YARA/Sigma/Suricata rules at reference URL.