🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 168.222.202.171:443.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1963350
IOC: 168.222.202.171:443
IOC Type :ip:port
Threat Type :botnet_cc
Malware: SalatStealer
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS44112 SWEB-AS
Country:- RU
First seen:2026-10-13 16:25:16 UTC
Last seen:never
UUID:bc868de9-c719-11f1-bd13-42010aa4000a
Reporter Daydream
Reward 5 credits from ThreatFox
Tags:SalatStealer TON webrat
Reference: https://bazaar.abuse.ch/sample/531540654836a5e5add5fe08432bc17c3582c1b0692b411278b1c96a3e5fe8db/

Avatar
Daydream
Salat Stealer fallback control server published through TON DNS. The stealer requests https://tonapi.io/v2/dns/webratpanel.ton/resolve and reads the 32-byte wallet address in the answer as text (main.decodeFromTonAddress), then uses https://<text>/sa1at/. On 2026-10-13 14:02 UTC the record for webratpanel.ton held 0:3136382e3232322e3230322e313731 followed by zero bytes, which is the text 168.222.202.171; shyetootval.ton returned the identical answer. Names decoded statically from 531540654836a5e5add5fe08432bc17c3582c1b0692b411278b1c96a3e5fe8db; record read through a urlquery scan of the public API. Port 443 follows from the https scheme. Server not contacted by us.