🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 85.137.53.167:25565.

Database Entry


IOC ID:1960414
IOC: 85.137.53.167:25565
IOC Type :ip:port
Threat Type :botnet_cc
Malware: Mirai
Malware alias:Katana
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS43641 Sollutium-NL
Country:- PL
First seen:2026-10-11 07:02:41 UTC
Last seen:never
UUID:94c74941-c516-11f1-bd13-42010aa4000a
Reporter ksi_digital
Reward 50 credits from anonymous
Tags:akuma cowrie elf honeypot Mirai

Avatar
ksi_digital
C2 of akuma_x64 (ddaadef14a9f..., x86-64), fetched in our isolated sandbox on 2026-10-11 by the akuma loader wget.sh (c87eecde...) from 85.137.53.167:24380/bins/telnet/; the loader reached our Cowrie Telnet honeypot via logins from 172.166.156.160. Run in the sandbox with only the download host reachable: the bot tried 85.137.53.167:25565 44 times. Same host as our earlier 85.137.53.167:3169 entry (older MIPS build). Confidence 75: sandbox-observed.