🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 185.113.10.26:4433.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1968834
IOC: 185.113.10.26:4433
IOC Type :ip:port
Threat Type :botnet_cc
Malware: GRIDTIDE
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS58232 haderan
Country:- IR
First seen:2026-10-16 06:10:32 UTC
Last seen:never
UUID:82e21f79-c918-11f1-bd13-42010aa4000a
Reporter z3r0s6
Reward 5 credits from ThreatFox
Tags:botnet elf go GRIDTIDE IoT
Reference: https://urlhaus.abuse.ch/host/185.113.10.26/

Avatar
z3r0s6
GRIDTIDE botnet C2. Open directory at http://185.113.10.26:8080/ served multi-arch Go ELF bots (bot/bot-armv5/bot-armv7/bot-mips/bot-mipsle) + grid-master server + install.sh dropper. install.sh hardcodes CNC=185.113.10.26:4433 and launches the bot with -cnc 185.113.10.26:4433; master.log confirms 'server listening on 0.0.0.0:4433' (admin on :4434). Family = GRIDTIDE from binary names grid-bot/grid-master (abuse.ch URLhaus also tagged the payloads 'grid'). Distribution URLs already on URLhaus (added 2026-10-14, online). Verified 2026-10-16.