🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain play.foundation.forum.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1974963
IOC: play.foundation.forum
IOC Type :domain
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is high (85%)
Is compromised? : True
ASN:AS174 COGENT-174
Country:- US
First seen:2026-10-20 05:11:38 UTC
Last seen:never
UUID:b5b057d1-cc33-11f1-bd13-42010aa4000a
Reporter Darkfibr
Reward 5 credits from ThreatFox
Tags:etherhiding freight-lure historical RAT

Avatar
Darkfibr
Historical C2 host of the freight-themed Node.js remote-access trojan, recovered from the on-chain write history of the BSC dead-drop contract 0xCc4BCd51e0eA7E254b0F30044538F6Cb86a4E61b: 18 set(string) writes from creator EOA 0xBA8B70D5B15cFbFD628F71560aAb996356c0fa84 between 2026-05-12 and 2026-10-12, each storing the live {"urls":[...]} list. Recovered with read-only eth_call and storage reads on an archive RPC (bsc-mainnet.public.blastapi.io); never contacted. The writer appended domains rather than replacing them, so this host stayed in the contract state until a later write removed it. First on-chain appearance window: 2026-05-12 to 2026-05-16 writes 1-4.