🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 63.179.162.160:16747.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1961356
IOC: 63.179.162.160:16747
IOC Type :ip:port
Threat Type :botnet_cc
Malware: Mirai
Malware alias:Katana
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS16509 AMAZON-02
Country:- US
First seen:2026-10-12 07:18:48 UTC
Last seen:never
UUID:39b80804-c60a-11f1-bd13-42010aa4000a
Reporter ksi_digital
Reward 50 credits from anonymous
Tags:akuma elf Mirai ngrok
Reference: https://github.com/ksi-digital/threat-research/tree/main/akuma-loader

Avatar
ksi_digital
akuma (Mirai-based) C2 moved to an ngrok TCP tunnel: 5.tcp.eu.ngrok.io:16747. Seen in the current x86-64 builds from 85.137.53.167:24380, /bins/dvr/akuma_x64 (1572ea5d3fbc...) and /bins/telnet/akuma_x64 (118385e79114...), both run in our isolated sandbox on 2026-10-12. Earlier builds used 85.137.53.167:25565 / :3169. 5.tcp.eu.ngrok.io resolves to six shared ngrok edge addresses; only the tunnel port 16747 is specific to this operator, so treat the hostname and edge IPs alone as shared infrastructure. Live check 2026-10-12 06:52Z: the edge accepted the bot on 63.179.162.160:16747 and took its registration (x86_64 / akuma.dvr); no reply from the backend after that. Confidence 75.