🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain ijdaiajsidjfif.cloud-ip.cc.

Database Entry


IOC ID:1970863
IOC: ijdaiajsidjfif.cloud-ip.cc
IOC Type :domain
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
First seen:2026-10-17 05:31:46 UTC
Last seen:never
UUID:02ccec64-c9e6-11f1-bd13-42010aa4000a
Reporter wristhulk
Reward 5 credits from ThreatFox
Tags:DDoS elf garble go
Reference: https://bazaar.abuse.ch/sample/44272f1f153709662b3b973e7b4a601df852e7eae3dd9a22661860394889b1eb/

Avatar
wristhulk
C2 of a garble-obfuscated Go DDoS bot (x86 ELF, sha256 44272f1f15370966...; MB labels it Mirai) delivered by sora.sh from 103.170.217.170, captured by our Cowrie honeypot 2026-10-14. Sandbox run (simulated network): the bot connects to TLS :443 and rotates through 7 hard-coded names; this ClouDNS dynamic-DNS name is the only registered one (explicit record, currently no A; the other six are NXDOMAIN: 39rwd49tgi9.xyz, 9egu923jfsdf.pro, w9triu9w8vs.ro, sg9sj8ifda.com, dfisjqef0s.app, sfoig93rafa.io). Floods: DNS/TCP/SYN/ACK/GRE/HTTP; persistence via systemd unit 'System Helper Service' -> /var/lib/.systemd_helper/.systemd_script.sh.