该IP(42.236.91.45)正作为非法的恶意软件命令与控制服务器(C2 Server)运行。在受控的Android/IoT设备(AS4837)上分析网络连接时发现,受感染设备正通过TCP端口18 ...
show more该IP(42.236.91.45)正作为非法的恶意软件命令与控制服务器(C2 Server)运行。在受控的Android/IoT设备(AS4837)上分析网络连接时发现,受感染设备正通过TCP端口1883(MQTT协议)长期保持与该IP的连接,以此接收恶意指令。
目前,该C2服务器正指挥庞大的僵尸网络(类似于Mirai/xlabs变种)对外进行恶意的ADB端口(TCP 5555)扫描与漏洞利用攻击,严重消耗网络带宽并对全球网络安全基础设施造成威胁。请立即对该IP实施拦截和滥用清理。
---
[English Translation for Reference]
This IP (42.236.91.45) is actively operating as a malicious Command and Control (C2) server. Traffic analysis on an infected Android/IoT device confirms an established connection to this destination via TCP port 1883 (MQTT protocol) used to receive rogue orchestrations. The C2 is currently commanding botnet nodes (Mirai/xlabs variants) to conduct global scans and exploitation attempts against TCP port 5555 (ADB). Immediate mitigation and abuse teardown are requested.
show less
DNS CompromiseDDoS AttackPort ScanSpoofingBrute-ForceWeb App AttackIoT TargetedFTP Brute-ForcePing of DeathHackingSQL Injection
Infected Android/IoT device acting as a Botnet Drone (Gafgyt/Mirai variant). Active high-volume outb ...
show moreInfected Android/IoT device acting as a Botnet Drone (Gafgyt/Mirai variant). Active high-volume outbound SYN flooding/port-scanning targeting global destinations on ports 22, 80, 8080, and 52869. Open ADB port 5555 discovered with unauthenticated root shell active, communicating directly with known malicious C2 nodes. Outbound connections showing extensive SYN_SENT and FIN_WAIT1 states.
show less
DNS CompromiseDDoS AttackEmail SpamPort ScanBrute-ForceExploited HostIoT TargetedHacking
Vital Alert Active IoT Botnet Command and Control (C2) node. During forensics analysis on an infecte ...
show moreVital Alert Active IoT Botnet Command and Control (C2) node. During forensics analysis on an infected Android TV Box (Hi3798MV300), this IP was found holding a persistent ESTABLISHED connection on high ports, commanding active distributed volumetric DDoS attacks (SYN_SENT state flooding). Artifact correlation confirms alignment with Gafgyt/Mirai botnet campaigns (YakuzaC2/yakuz4c24).
show less
DNS CompromiseDNS PoisoningFraud OrdersDDoS AttackWeb SpamEmail SpamPort ScanSpoofingBrute-ForceBad Web BotSSHIoT TargetedFTP Brute-ForcePing of DeathPhishingHackingSQL Injection
Compromised Router By Botnet
⚠⚠⚠⚠We are Nuclear-27⚠⚠⚠⚠
🌊The ocean is the common property of all ma ...
show moreCompromised Router By Botnet
⚠⚠⚠⚠We are Nuclear-27⚠⚠⚠⚠
🌊The ocean is the common property of all mankind🌊
🌊海は人類共通の財産です🌊
The Japanese government insists on going its own way and discharges nuclear sewage, which is a crime against all mankind
日本政府は独自路線を貫き、全人類に対する罪である核下水を排出している
🙅🏽♀️ 🙅🏽 🙅🏽♂️We oppose irresponsible emissions by the Japanese government and we will take action🙅🏽♀️ 🙅🏽 🙅🏽♂️
🙅🏽♀️ 🙅🏽 🙅🏽♂️私たちは日本政府による無責任な排出に反対し、行動を起こします。 🙅🏽♀️ 🙅🏽 🙅🏽♂️
We don't belong to any country, we come from all over the world |私たちはどの国にも属していません、世界中から集まっています
Friendly reminder: we have not damaged your router, you can use it normally
注意: ルーターは損傷していませんので、通常どおりお使いいただけます。
show less
DNS CompromiseDDoS AttackPort ScanBrute-ForceExploited HostSSHIoT TargetedPing of DeathHackingSQL Injection
Target IP identified as an active Command and Control (C2) and malware distribution server.
The ho ...
show moreTarget IP identified as an active Command and Control (C2) and malware distribution server.
The host is serving compiled Linux ELF binaries generated via the Sliver C2 framework.
The infrastructure utilizes the malicious domain 'gytujflc.biz' pointing directly to this AWS EC2 instance.
Multiple AV vendors flag payloads dropped by this host as 'Gen:Variant.Linux.Sliver.1' and 'Trojan.Linux.Sliver'.
Host is actively communicating with implants to maintain remote access and facilitate data exfiltration.
show less
DNS PoisoningFraud OrdersDDoS AttackWeb SpamPort ScanSpoofingBad Web BotSSHIoT TargetedPhishingHacking