🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 103.194.186.118:19999.

Database Entry


IOC ID:1982213
IOC: 103.194.186.118:19999
IOC Type :ip:port
Threat Type :botnet_cc
Malware: XMRIG
Confidence Level : Confidence level is high (95%)
Is compromised? : False
ASN:AS45753 NETSEC-HK
Country:- HK
First seen:2026-10-23 16:57:40 UTC
Last seen:never
UUID:bf956059-cefe-11f1-a74e-42010aa4000a
Reporter ukkz
Reward 5 credits from ThreatFox
Tags:cryptojacking CVE-2026-110447 monero nextcloud
Reference: https://wz-it.com/en/blog/nextcloud-built-in-code-server-cve-2026-110447-rce-webshell/

Avatar
ukkz
Monero mining pool node observed as outbound C2 from XMRig variant deployed via CVE-2026-110447 (Nextcloud/Collabora Built-in CODE Server). Attacker wallet 85GCqQj...PHcE.