🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 176.65.144.127:3847.

Database Entry


IOC ID:1891107
IOC: 176.65.144.127:3847
IOC Type :ip:port
Threat Type :botnet_cc
Malware: Unknown RAT
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS209413 DEDIK-CH
First seen:2026-08-30 07:09:44 UTC
Last seen:2026-08-30 08:25:34 UTC
UUID:b8d3fc7a-a3c9-11f1-9e13-42010aa4000a
Reporter Justice_Hammer
Reward 5 credits from ThreatFox
Tags:ComponentTask33 etherhiding MSI-loader NodeJS-RAT on-chain-c2 Polygon
Reference: https://github.com/Justice-Hammer/threat-hunting-detections/blob/main/30-research/RES-0007%20-%20ComponentTask33%20MSI%20Loader%20with%20On-Chain%20C2%20Discovery.md

Avatar
Justice_Hammer
Resolved C2 panel address, cleartext WebSocket. Wire-observed 2026-08-27. Sits in shared bulletproof space - co-tenancy in this /24 is NOT evidence of a shared operator.