🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 192.162.199.167:406.

Database Entry


IOC ID:2019857
IOC: 192.162.199.167:406
IOC Type :ip:port
Threat Type :botnet_cc
Malware: MopsStealer
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS214351 FEMOIT
Country:- GB
First seen:2026-11-08 07:27:09 UTC
Last seen:never
UUID:424afe30-db0d-11f1-a74e-42010aa4000a
Reporter fbazs
Reward 5 credits from ThreatFox
Tags:fake-plugin MopsStealer PluginDex Websocket
Reference: https://threatfox.abuse.ch/ioc/2001287/

Avatar
fbazs
C2 of the payload dropped by the malicious libcurl.dll (SHA256 22dadd303759f12dc11a17b7612178dd5a8615cbf365a3a617faa181438c8273, on MalwareBazaar) from Plugin_Setup_4.6.5.zip served by the fake plugin catalogue wppluginindex[.]com. The payload connects to mopsikimilie.cc (ThreatFox 2001287, MopsStealer) on TCP 406 over WebSocket. mopsikimilie.cc resolved to 192.162.199.167 on 2026-11-08.