🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain cnc.murrezbots.vip.

Database Entry


IOC ID:2013809
IOC: cnc.murrezbots.vip
IOC Type :domain
Threat Type :botnet_cc
Malware: Mirai
Malware alias:Katana
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS197170 TECHTIES-AS
Country:- DE
First seen:2026-11-04 07:25:11 UTC
Last seen:never
UUID:ab9917bf-d7fb-11f1-a74e-42010aa4000a
Reporter aacunaa
Reward 5 credits from ThreatFox
Tags:Mirai murrezbots wraith
Reference: https://github.com/aacunaa/scgx02-iocs

Avatar
aacunaa
Mirai C2 domain (variant tagged 'wraith' on MalwareBazaar). On 2026-05-08 94.26.106.29 (AS197170 TechTies) presented a TLS certificate for cnc.murrezbots.vip while serving /bins/ loaders (URLhaus, 2026-05-06; MalwareBazaar e64d909993647ed17312cea32f60ec65d71dd440ac126d2360aaeeaaf72f7cc1, eead126f579323883adaee039a9c46ebc855dbd21d399c35ef746266bfecffd8). Both names still resolve to 94.26.106.29 on 2026-11-04; the same IP now hosts a Microsoft 365 AiTM phishing proxy (Green Proxy PhaaS). Reported by Raiku Solutions.