🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain p.2137gang.shop.

Database Entry


IOC ID:1982171
IOC: p.2137gang.shop
IOC Type :domain
Threat Type :botnet_cc
Malware: RedTail
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS202412 OMEGATECH-AS
Country:- GB
First seen:2026-10-23 16:11:45 UTC
Last seen:never
UUID:7714b901-cef7-11f1-a74e-42010aa4000a
Reporter Fenestra
Reward 5 credits from ThreatFox
Tags:CVE-2021-41773 CVE-2026-109618 php2shell Redtail ssh telnet xmrig

Avatar
Fenestra
RedTail cryptominer (XMRig 6.26.0 based) C2/mining-proxy endpoints recovered by Fenestra dynamic analysis of redtail.x86_64 (sha256 f0aa83bbbd2c75e2f71ec16029ee5fcfad59f3a8efa30a500b815f0f6c18d987), Oct 2026. Names resolved via DNS-over-TLS to hard-coded public resolvers; tcp/43782 custom encrypted channel (every session starts 40680d1b05000000), tcp/2137 Stratum (login x/x, wallet held at the proxy). All names resolve to 130.12.180.51, which is also a RedTail SSH-spreading source on our honeypots (Sep-Oct 2026).