🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 202.78.167.55:8765.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1975458
IOC: 202.78.167.55:8765
IOC Type :ip:port
Threat Type :payload_delivery
Malware: Unknown malware
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS202422 GHOST
Country:- LU
First seen:2026-10-20 15:53:47 UTC
Last seen:never
UUID:9539f4ab-cc6c-11f1-bd13-42010aa4000a
Reporter tinnendo
Reward 5 credits from ThreatFox
Tags:botnet cve-2026-96656 DDoS plex python

Avatar
tinnendo
HTTP server distributing the malware (py_beacon.py, attack2.py, keep_conn.py). The same IP exploited Plex Media Server via CVE-2026-96656 (PUT /:/prefs?TranscoderH264Options=dump-yuv=...Codecs/.../zz*.so) on 2026-10-19/20. Hosted at G-Core Labs (GCL-CUSTOMER-JP).