bore.pub:26910

domain C2 resolving

Tracked by C2 Tracker · Updated as of 2026-10-11 · Whois queried 2026-10-07T08:17:24

Registration

Registrar: Porkbun LLC
Registered: 2022-04-06T06:20:09.854Z
Expires: 2027-04-06T06:20:09.854Z

DNS

Resolves to: 159.223.110.159
Nameservers: ns1.digitalocean.com, ns2.digitalocean.com, ns3.digitalocean.com
Status: -

Observed in malware

Family	Sample SHA-256	Role	First seen
AndroRat	2253c72e39d5…	C2	2026-10-03

About AndroRat

One of the oldest open-source Android RATs (first released ~2012), still repackaged into fresh campaigns. Classic builds carry the my.app.client package; repackaged flavors ship under innocuous package names and app titles like "Google Service Framework".

Bitdefender: An Android RAT possibly born in Italy, reported in China

Signing certificate

Subject CN: Android Debug
Issuer CN: Android Debug
Valid: 2026-08-25 → 2056-08-17
Fingerprint: 91a17b1b88b82bf237d799ae682ba5c56e523c01d06ebbf17f40f604d5ed7ecf

Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.