🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 195.208.21.65:443.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1982402
IOC: 195.208.21.65:443
IOC Type :ip:port
Threat Type :botnet_cc
Malware: SalatStealer
Confidence Level : Confidence level is moderate (50%)
Is compromised? : False
ASN:AS44112 SWEB-AS
Country:- RU
First seen:2026-10-24 06:08:53 UTC
Last seen:2026-11-08 00:28:16 UTC
UUID:6d787aa7-cf2b-11f1-a74e-42010aa4000a
Reporter wristhulk
Reward 5 credits from ThreatFox
Tags:dead-drop SalatStealer TON webrat

Avatar
wristhulk
SalatStealer (WebRAT) C2: second address in the TON DNS wallet record of webratxaye1.ton (ASCII list 196.196.208.18,195.208.21.65), read passively on 2026-10-23. Port inferred: build 2d14c4c6626d132fceb3e7639a344875db53c10b39a32f0069c3d9453720cd88 connected to the first address of the same list on TCP 443 in our sandbox, but did not reach this one there, hence confidence 50.