auto.c3pool[.]orgDomain
Reported by 2 independent sources · first reported by Elastic Security Labs · last reported
Last reported 30 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
The Not So Silent Miner: Threat Actor Compiles Cryptominer on the Endpoint“…o="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=auto.c3pool[.]org:19999 --user=[REDACTED] --pass=186605 --cpu-max-threads-hint=100 --cinit-idle-wait=5 --cinit-idle-cpu=100”
-
Betting on Bots: Investigating Linux malware, crypto mining, and gambling API abuse“-o stratum+tcp://auto.c3pool[.]org:19999 -u 41qBGWTRXUoUMGXsr78Aie3LYCBSDGZyaQeceMxn11qi9av1adZqsVWCrUwhhwqrt72qTzMbweeqMbA89mnFepja9XERfHL -p R”
Indicators reported together
named in the same reports- hxxp://194.87.89[.]30:8899/anydesk.exein 1 report
- 194.87.89[.]30in 1 report
- 0d202e16408770e8…060315b30dd1in 1 report
- hxxp://61.160.194[.]160:35130in 1 report
- 61.160.194[.]160in 1 report
- hxxp://107.178.101[.]245:5488/l64;chmodin 1 report
- 107.178.101[.]245in 1 report
- hxxp://107.178.101[.]245:5488/l86;chmodin 1 report
- hxxp://107.178.101[.]245:5488in 1 report
- nishabii[.]xyzin 1 report
- c3pool[.]orgin 1 report
- hxxp://91.92.241[.]103:8002/gk.phpin 1 report
- 91.92.241[.]103in 1 report
Copy these 13 indicators · defanged
Also named with it: CVE-2021-4034, CVE-2025-4632, CVE-2024-7399
Thanks — we review every report.