XMRig TLS mining proxy :443 (pinned fingerprint) in the Plex2Shell campaign miner config, 2026-10-26 ...
show moreXMRig TLS mining proxy :443 (pinned fingerprint) in the Plex2Shell campaign miner config, 2026-10-26.
show less
XMRig stratum endpoint :10001 in the miner config of the Plex2Shell campaign; compromised host held ...
show moreXMRig stratum endpoint :10001 in the miner config of the Plex2Shell campaign; compromised host held a live connection 2026-10-26 18:17 UTC.
show less
Malware distribution host and C2 for the Plex2Shell XMRig campaign: http://89.125.187.222:18899/plex ...
show moreMalware distribution host and C2 for the Plex2Shell XMRig campaign: http://89.125.187.222:18899/plex_deploy.sh and /bin/xmrig; cc-client on :5432. Observed 2026-10-25/26. Ref KG-2026-10-26-PLEX2SHELL.
show less
[2026-10-26 (7 probing requests, likely compromised residential host)] Exploited Plex Media Server " ...
show more[2026-10-26 (7 probing requests, likely compromised residential host)] Exploited Plex Media Server "Plex2Shell" chain (CVE-2026-96652/96654/96655/96656) against TCP/32400 on a private home server, achieved RCE and installed XMRig cryptominer. Payload hosts 89.125.187.222:18899 / 130.94.112.118:18899. Incident ref KG-2026-10-26-PLEX2SHELL.
show less
[2026-10-26 (43 requests); also serves the malware installer on :18899] Exploited Plex Media Server ...
show more[2026-10-26 (43 requests); also serves the malware installer on :18899] Exploited Plex Media Server "Plex2Shell" chain (CVE-2026-96652/96654/96655/96656) against TCP/32400 on a private home server, achieved RCE and installed XMRig cryptominer. Payload hosts 89.125.187.222:18899 / 130.94.112.118:18899. Incident ref KG-2026-10-26-PLEX2SHELL.
show less
[2026-10-26 16:46 UTC, authenticated with a stolen token; also mining proxy :10002] Exploited Plex M ...
show more[2026-10-26 16:46 UTC, authenticated with a stolen token; also mining proxy :10002] Exploited Plex Media Server "Plex2Shell" chain (CVE-2026-96652/96654/96655/96656) against TCP/32400 on a private home server, achieved RCE and installed XMRig cryptominer. Payload hosts 89.125.187.222:18899 / 130.94.112.118:18899. Incident ref KG-2026-10-26-PLEX2SHELL.
show less
[2026-10-26 (48 requests on each of two servers)] Exploited Plex Media Server "Plex2Shell" chain (CV ...
show more[2026-10-26 (48 requests on each of two servers)] Exploited Plex Media Server "Plex2Shell" chain (CVE-2026-96652/96654/96655/96656) against TCP/32400 on a private home server, achieved RCE and installed XMRig cryptominer. Payload hosts 89.125.187.222:18899 / 130.94.112.118:18899. Incident ref KG-2026-10-26-PLEX2SHELL.
show less
[2026-10-26 13:29 UTC (also read server credential file)] Exploited Plex Media Server "Plex2Shell" c ...
show more[2026-10-26 13:29 UTC (also read server credential file)] Exploited Plex Media Server "Plex2Shell" chain (CVE-2026-96652/96654/96655/96656) against TCP/32400 on a private home server, achieved RCE and installed XMRig cryptominer. Payload hosts 89.125.187.222:18899 / 130.94.112.118:18899. Incident ref KG-2026-10-26-PLEX2SHELL.
show less
[2026-10-26 12:51 UTC] Exploited Plex Media Server "Plex2Shell" chain (CVE-2026-96652/96654/96655/96 ...
show more[2026-10-26 12:51 UTC] Exploited Plex Media Server "Plex2Shell" chain (CVE-2026-96652/96654/96655/96656) against TCP/32400 on a private home server, achieved RCE and installed XMRig cryptominer. Payload hosts 89.125.187.222:18899 / 130.94.112.118:18899. Incident ref KG-2026-10-26-PLEX2SHELL.
show less
[2026-10-26 11:47, 17:10 UTC (3 sessions)] Exploited Plex Media Server "Plex2Shell" chain (CVE-2026- ...
show more[2026-10-26 11:47, 17:10 UTC (3 sessions)] Exploited Plex Media Server "Plex2Shell" chain (CVE-2026-96652/96654/96655/96656) against TCP/32400 on a private home server, achieved RCE and installed XMRig cryptominer. Payload hosts 89.125.187.222:18899 / 130.94.112.118:18899. Incident ref KG-2026-10-26-PLEX2SHELL.
show less
[2026-10-26 15:50 UTC] Exploited Plex Media Server "Plex2Shell" chain (CVE-2026-96652/96654/96655/96 ...
show more[2026-10-26 15:50 UTC] Exploited Plex Media Server "Plex2Shell" chain (CVE-2026-96652/96654/96655/96656) against TCP/32400 on a private home server, achieved RCE and installed XMRig cryptominer. Payload hosts 89.125.187.222:18899 / 130.94.112.118:18899. Incident ref KG-2026-10-26-PLEX2SHELL.
show less
Web App AttackHacking
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.