Public
- Public
- Network
- Groups
- Featured
- Popular
- People

Conversation

Notices

Embed this notice
Brian Clark (deepthoughts10@infosec.exchange)'s status on Sunday, 16-Mar-2025 04:06:04 JST Brian Clark
- ScumBots
The free service from portmap.io is being abused to support malware C2 communications. If you don’t use it, I suggest blocking *.portmap.io via DNS, NGFW and/or web proxy.
#cybersecurity #threatintel
From: @ScumBots
https://infosec.exchange/@ScumBots/114167879065509347
In conversation about a month ago from infosec.exchange permalink
Attachments
1. Domain not in remote thumbnail source whitelist: portmap.io
  
  Portmap.io - free port forwarding solution
  
  Expose your local PC to Internet from behind firewall and without real IP address
2. No result found on File_thumbnail lookup.
  
  ScumBots (@ScumBots@infosec.exchange)
  
  from ScumBots
  
  #StagedC2 config observed at Sat Mar 15 18:09:04 2025 UTC, located at hXXps://pastebin[.]com/raw/a0epCKQK C2: xdeadlylez-30616[.]portmap[.]io:30616 (IP: 193.161.193.99)

Feeds