🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 93.152.209.8:7000.

Database Entry


IOC ID:2016461
IOC: 93.152.209.8:7000
IOC Type :ip:port
Threat Type :botnet_cc
Malware: Unknown Stealer
Confidence Level : Confidence level is high (100%)
Is compromised? : True
ASN:AS58215 Omniline-net-as
Country:- CZ
First seen:2026-11-06 05:46:12 UTC
Last seen:never
UUID:99c14b53-d96b-11f1-a74e-42010aa4000a
Reporter fbazs
Reward 5 credits from ThreatFox
Tags:Deno fake-plugin hhunter orbit winget

Avatar
fbazs
Observed on a compromised Windows 10 host, October 30 to November 5, 2026. Chain: winget installs DenoLand.Deno 2.9.7 silently, code stored in HKCU registry values, HKCU Run value launches conhost --headless and deno eval, injection into explorer.exe, HTTPS C2 on 93.152.209.8:8443. Internal names: hhunter, Orbit, Halvern. Same IP showed Plugindex and hhunter Dashboard titles on ports 9091 and 9443 (Shodan, 2026-10-25). No sample shared.