🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://discord.com/api/webhooks/1548809420358549526/iDDGbQRMab24avMSNZ14Y1xGr-dvd9JQZKs5xgdho4zuJ1Fh4Pu2pzhv0sL1msK2X9BI.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:2019975
IOC: https://discord.com/api/webhooks/1548809420358549526/iDDGbQRMab24avMSNZ14Y1xGr-dvd9JQZKs5xgdho4zuJ1Fh4Pu2pzhv0sL1msK2X9BI
IOC Type :url
Threat Type :botnet_cc
Malware: Unknown Stealer
Confidence Level : Confidence level is high (100%)
Is compromised? : False
ASN:AS13335 CLOUDFLARENET
Country:- US
First seen:2026-11-08 07:47:46 UTC
Last seen:never
UUID:d59d8d59-db1d-11f1-a74e-42010aa4000a
Reporter LoneNco
Reward 5 credits from ThreatFox
Tags:discord-webhook ens etherhiding ewa EXFILTRATION IRAHook java minecraft stealer
Reference: https://bazaar.abuse.ch/sample/80a4f9250bf9a8dca131a0a2b1b9525e9338aa79c8d9d295bc61dd61db965ddf/

Avatar
LoneNco
C2 config of the 'ewa'/irahook Java infostealer (stage 2 of fake Minecraft Fabric mods, e.g. loader 66cd0c8614ada8ef7600c0903ca4795b2f97162c6ef1c4718b1a26879865aab3). Recovered by decrypting AES-GCM ENS text records on el.turko.eth (resolver 0xf29100983e058b709f3d539b0c765937b804ac15) with the sample's own code. Record 'ewa' -> wss://ewababa.sbs/ws (WebSocket C2); record 'windowskernel' -> Discord exfil webhook; also Telegram exfil bots: bot ID 9197003515 (chat 8806136549) and bot ID 8377690969 (chat 7667295419), tokens withheld and reported to Telegram. Observed 2026-11-08.