🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 185.228.72.128:21.

Database Entry


IOC ID:1970480
IOC: 185.228.72.128:21
IOC Type :ip:port
Threat Type :payload_delivery
Malware: Unknown malware
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS400992 ZHOUYISAT-COMMUNICATIONS
Country:- RU
First seen:2026-10-17 05:33:11 UTC
Last seen:2026-10-17 00:21:06 UTC
UUID:fcea3ab0-c9ac-11f1-bd13-42010aa4000a
Reporter wristhulk
Reward 5 credits from ThreatFox
Tags:honeypot Sh
Reference: https://bazaar.abuse.ch/sample/823efb0d0247dd4d178f07e6ac7a564697ddac95036f311ef1beabd5f4cfd71e/

Avatar
wristhulk
Payload server seen by our Cowrie honeypot: 176.91.213.22 told it to fetch ftp://185.228.72.128/ftpget.sh (2026-10-16 21:59:51 UTC). Re-fetched in isolation and verified live, serving the same bytes Cowrie captured (sha256 823efb0d0247dd4d178f07e6ac7a564697ddac95036f311ef1beabd5f4cfd71e).