🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 217.60.195.65:4000.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1943799
IOC: 217.60.195.65:4000
IOC Type :ip:port
Threat Type :botnet_cc
Malware: Evilginx
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS209373 SWISSNET-AS
Country:- IR
First seen:2026-10-01 11:03:42 UTC
Last seen:never
UUID:3fdfa585-bd86-11f1-a463-42010aa4000a
Reporter Anonymous
Reward 5 credits from ThreatFox
Tags:aitm coinmerce evilginx2 phishing

Avatar
Anonymous
Confirmed Evilginx2-associated phishing infrastructure.

TCP/4000 exposes a Node.js/Express "Capture Panel". Verbose error handling discloses the filesystem path:

/root/evilginx2/web-panel/node_modules/...

The same IP is actively hosting an AiTM phishing campaign impersonating Coinmerce. The phishing backend receives submitted email addresses, passwords and OTP/MFA codes.

Observed infrastructure:
IP: 217.60.195.65
Panel: http://217.60.195.65:4000/login
Phishing host: platform.coinmerce.icu