ThreatFox IOC Database

You are viewing the ThreatFox database entry for ip:port 194.150.166.244:8080.

Database Entry

IOC ID:	2025025
IOC:	194.150.166.244:8080
IOC Type :	ip:port
Threat Type :	botnet_cc
Malware:	Unknown Stealer
Confidence Level :	Confidence level is elevated (75%)
Is compromised? :	False
ASN:	AS215311 REGXA-CLOUD
Country:	IQ
First seen:	2026-11-12 06:49:04 UTC
Last seen:	never
UUID:	54943569-de00-11f1-a74e-42010aa4000a
Reporter	aboutte
Reward	5 credits from ThreatFox
Tags:	AS215311 exfil Github npm wfx-docs Worm
Reference:	https://github.com/search?q=wfx-audit.md&type=pullrequests

aboutte

Exfiltration endpoint of a self-propagating GitHub token worm (identical 'wfx-docs' PRs, 38,000+ since 2026-11-10), as described in a victim's public report of 2026-11-11 (third-party report, not independently reproduced). Stolen GitHub OAuth/PAT tokens are used to find writable repos, add a hidden .ci-XXXXXX.sh script and an npm postinstall hook in package.json that runs it on npm install. Stolen data is reportedly POSTed to http://194.150.166.244:8080/exfil. Hosting: Regxa Cloud, AS215311 (IQ), geolocated GB.