87.237.53.199
ip C2Tracked by C2 Tracker · Updated as of 2026-10-11 · Whois queried 2026-10-05T10:38:03
Network
- Network
- DE-ZAP-HOSTING
- CIDR
- 87.237.53.0/24
- Country
- DE
Contact
- Handle
- 87.237.53.0 - 87.237.53.255
- Abuse
- [email protected]
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| GlitchSpy | 80af5e921cf8… | C2 | 2026-06-16 |
About GlitchSpy
**GlitchSpy** is an Accessibility-abusing Android banking RAT. Using Accessibility services it performs overlay credential theft, automated UI actions and keylogging against banking and rewards apps, self-updating through benign-looking domains (mobileappupdate.com, sportypointsrewards.com) while beaconing to hard-coded operator IPs (134.255.232.216, 87.237.53.199).
Signing certificate
- Subject CN
- Kooooo Release
- Issuer CN
- Kooooo Release
- Valid
- 2026-03-30 → 2053-08-15
- Fingerprint
- 8e680f86bbca985104039dad318456f974aaff3667a3e805d23e492eaed7545a
Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.