169.254.183.238:8000
ip C2Tracked by C2 Tracker · Updated as of 2026-10-11 · Whois queried 2026-10-07T08:17:26
Network
- Network
- LINKLOCAL-RFC3927-IANA-RESERVED
- CIDR
- 169.254.0.0/16
- Country
- US
Contact
- Handle
- NET-169-254-0-0-1
- Abuse
- -
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| AndroRat | d70a74fc7c87… | C2 | 2026-10-03 |
About AndroRat
One of the oldest open-source Android RATs (first released ~2012), still repackaged into fresh campaigns. Classic builds carry the my.app.client package; repackaged flavors ship under innocuous package names and app titles like "Google Service Framework".
Signing certificate
- Subject CN
- Android Debug
- Issuer CN
- Android Debug
- Valid
- 2026-08-25 → 2056-08-17
- Fingerprint
- 91a17b1b88b82bf237d799ae682ba5c56e523c01d06ebbf17f40f604d5ed7ecf
Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.