ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 141.94.96.195:443.

Database Entry

This IOC is of poor quality

Our automated checks indicate that this IOC is of poor quality. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.

This IOC expired

This IOC is an old IOC and hence has expired on 2026-09-21 01:15:04 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.

IOC ID:	1891249
IOC:	141.94.96.195:443
IOC Type :	ip:port
Threat Type :	botnet_cc
Malware:	XMRIG
Confidence Level :	Confidence level is high (90%)
Is compromised? :	True
ASN:	AS16276 OVH
Country:	FR
First seen:	2026-08-30 07:09:29 UTC
Last seen:	never
UUID:	b619a47b-a411-11f1-9e13-42010aa4000a
Reporter	Stateoftheattack
Reward	5 credits from ThreatFox
Tags:	cryptojacking docker-api monero xmrig

Stateoftheattack

Private Monero mining proxy. Observed configured as the PRIMARY pool in an xmrig invocation deployed to an internet-facing Docker API on a European device, with pool.supportxmr.com:3333 only as fallback. Miner delivered as a tar via the Docker put-archive endpoint, preceded by pkill -f xmrig to evict competing miners. Payout subaddress links this operator across three source addresses over six days. Port 443 is the TLS listener and tried first; 3333 is the cleartext fallback.