🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 217.60.195.113:443.

Database Entry


IOC ID:1888897
IOC: 217.60.195.113:443
IOC Type :ip:port
Threat Type :botnet_cc
Malware: RedTail
Confidence Level : Confidence level is high (90%)
Is compromised? : False
ASN:AS209373 SWISSNET-AS
Country:- IR
First seen:2026-08-27 07:21:35 UTC
Last seen:never
UUID:e0eaa1e3-a1ae-11f1-9e13-42010aa4000a
Reporter Chuan_jian_guo
Reward 5 credits from ThreatFox
Tags:cryptominer Redtail ssh-worm xmrig
Reference: https://beelzebub.ai/blog/redtail-docker-api-campaign-evolves

Avatar
Chuan_jian_guo
RedTail cryptominer C2. Serves /sh loader, /clean rival-killer, multi-arch binaries. Captured 2026-08-26 via SSH honeypot; scp dlr@ staging with HTTPS fallback. Same C2 in Beelzebub June 2026 Docker API campaign.