🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 91.92.43.221:5555.

Database Entry


IOC ID:1990748
IOC: 91.92.43.221:5555
IOC Type :ip:port
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS207043 DEDIK-IO
First seen:2026-10-26 13:15:49 UTC
Last seen:never
UUID:7e4bada0-d13e-11f1-a74e-42010aa4000a
Reporter tipo_deincognito
Reward 10 credits from sektor7_intel
Tags:c2 DDoS IranBot

Avatar
tipo_deincognito
Current A record for the Iranbot C2 domain minecraftsmp14.duckdns.org. The x86_32 sample resolves the domain and connects to TCP/5555 with a HELLO handshake.