🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain ota.proxystream.st.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1972577
IOC: ota.proxystream.st
IOC Type :domain
Threat Type :botnet_cc
Malware: XMRIG
Confidence Level : Confidence level is high (95%)
Is compromised? : True
ASN:AS213790 LimitedNetwork-AS
Country:- GB
First seen:2026-10-18 10:28:15 UTC
Last seen:2026-10-18 10:00:25 UTC
UUID:b124445f-cada-11f1-bd13-42010aa4000a
Reporter a3igner
Reward 5 credits from ThreatFox
Tags:codec-cache cve-2026-96656 elf miner plex

Avatar
a3igner
Plex Media Server codec-cache implant (CVE-2026-96656): an unsigned .so dropped in the codec directory runs a constructor on every transcode and pipes the dropper URL into /bin/sh, installing an xmrig/RandomX miner (--rig-id plexdocker).