🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain www.autoccb.tech.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1975447
IOC: www.autoccb.tech
IOC Type :domain
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS13335 CLOUDFLARENET
Country:- US
First seen:2026-10-20 15:53:51 UTC
Last seen:never
UUID:f73787ac-cc6b-11f1-bd13-42010aa4000a
Reporter tinnendo
Reward 5 credits from ThreatFox
Tags:botnet cve-2026-96656 DDoS plex python

Avatar
tinnendo
C2 of a Python DDoS bot ("py-beacon v1", sha256 cababb6448ee3f2a274f516dc6b0fdc9f47d084a84d7bd164546c9c4b1755d44) dropped via Plex Media Server exploitation (CVE-2026-96656) from 202.78.167.55. Beacon polls https://www.autoccb.tech/api/v1/poll?id=<bot>&k=<token> every 60-90s and returns output via /api/v1/result. Observed 2026-10-19/20 on a compromised host. Domain registered 2026-09-10 (Hostinger), behind Cloudflare.