🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 107.182.130.29:2250.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1943162
IOC: 107.182.130.29:2250
IOC Type :ip:port
Threat Type :botnet_cc
Malware: OtterCookie
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS14315 1GSERVERS
Country:- US
First seen:2026-09-30 19:00:34 UTC
Last seen:never
UUID:8a7cb61c-bcf9-11f1-a463-42010aa4000a
Reporter Anonymous
Reward 5 credits from ThreatFox
Tags:ContagiousInterview git-hook InvisibleFerret NodeJS XCTDH
Reference: https://tria.ge/260930-weq99aed46/behavioral1

Avatar
Anonymous
Socket.IO remote shell C2 (/socket.io/?transport=websocket&EIO=4, HTTP 101). Stage 5 installs form-data, ws, socket.io-client, node-pty into ~/.vscode for an interactive terminal. Stage 5 of git-hook chain (fake 'Buzzol' repo): 84.200.33.163 -> parser.js -> TRON TMpR4viF4xPeMAcgYDoF57ECAaDPpj1oXs -> BSC tx 0x4e1c5867249c1768eff6e2467d1983ae92cb60d28345b8424b080df32f9cd770 -> stage 4 -> 104.234.94.198:1144/s/30621346/<host>_<user> -> stage 5 (node -e, global g='346' h='36', sha256 9a7c336c943bc92bf20bc698417653eb12a039f2a5b56bd1a12396ca99209b5b). Detonated on Tria.ge.