🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url http://212.83.185.19/footerd.png.

Database Entry


IOC ID:1982215
IOC: http://212.83.185.19/footerd.png
IOC Type :url
Threat Type :payload_delivery
Malware: XMRIG
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS12876 AS12876
Country:- FR
First seen:2026-10-23 16:57:40 UTC
Last seen:never
UUID:1c933346-ceff-11f1-a74e-42010aa4000a
Reporter ukkz
Reward 5 credits from ThreatFox
Tags:collabora cryptojacking CVE-2026-110447 monero nextcloud xmrig-dropper
Reference: https://wz-it.com/en/blog/nextcloud-built-in-code-server-cve-2026-110447-rce-webshell/

Avatar
ukkz
Live malware delivery URLs for CVE-2026-110447 (Nextcloud Collabora Built-in CODE Server) exploitation. footerd.png is UPX-packed Go XMRig (6MB). bottom-xe.png is 793-byte bash bootstrap. First-party observation.