🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 165.232.73.74:80.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1924239
IOC: 165.232.73.74:80
IOC Type :ip:port
Threat Type :botnet_cc
Malware: AMOS
Malware alias:Atomic macOS Stealer
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS14061 DIGITALOCEAN-ASN
Country:- US
First seen:2026-09-19 05:52:48 UTC
Last seen:never
UUID:526e33df-b3a4-11f1-abee-42010aa4000a
Reporter c4ffeine
Reward 5 credits from ThreatFox
Tags:Amos cc2 ClickFix Foxveil macOS
Reference: https://www.virustotal.com/gui/file/a3dabccd14492f4c70658ece96a3ed7b4e275ff9d70c434298bd6f863d1e24b9

Avatar
c4ffeine
Telemetry endpoint of the Foxveil/AMOS 'cc2' build (http://165.232.73.74/api/metrics/run), recovered by decrypting the loader's embedded AppleScript (parent Mach-O a3dabccd14492f4c70658ece96a3ed7b4e275ff9d70c434298bd6f863d1e24b9). DigitalOcean. Verified over Tor 2026-09-18 20:57 UTC: /api/metrics/run answers GET with the campaign's forged 139-byte 404 (sha256 5d1d75b7...), while / and random paths return the stock 146-byte nginx 404, the same route-selective behaviour as the 'apph4' telemetry host 178.128.253.92.