TF-1811903
high
📛 Threat Title
KongTuke: Domain name that delivers a malware payload 1eh2e3taw3g.com
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: KongTuke (aliases: TAG-124,js.LandUpdate808). Confidence: 100. First seen: 2026-05-13 17:47:21 UTC. Last seen: 2026-05-13 18:06:03 UTC. Reporter: monitorsg. Tags: Kongtuke.
Indicators of Compromise (5)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
ipv4
188.114.96.2
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/188.114.96.2
IOC database
- Type
- ipv4
- Value
188.114.96.2- First seen
- Last seen
- Attached to this threat
- Appears in
- 44 threats
- Description
- Resolved from domain xisabarajeonventures.click
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/188.114.96.2
ipv4
188.114.97.2
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/188.114.97.2
IOC database
- Type
- ipv4
- Value
188.114.97.2- First seen
- Last seen
- Attached to this threat
- Appears in
- 44 threats
- Description
- Resolved from domain xisabarajeonventures.click
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/188.114.97.2
ipv4
188.114.96.3
VT 0 / 92
IOC database
- Type
- ipv4
- Value
188.114.96.3- First seen
- Last seen
- Attached to this threat
- Appears in
- 105 threats
- Description
- Resolved from domain xingshang734.xyz
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
Basic Properties
| Network | 188.114.96.0/22 |
| AS owner | Cloudflare, Inc. |
| ASN | 13335 |
History
| Last analysis | 2026-05-16 04:56 UTC |
| Last modified on VirusTotal | 2026-05-16 04:57 UTC |
| WHOIS record date | 2026-05-07 15:07 UTC |
ipv4
188.114.97.3
VT 8 / 92
IOC database
- Type
- ipv4
- Value
188.114.97.3- First seen
- Last seen
- Attached to this threat
- Appears in
- 105 threats
- Description
- Resolved from domain xingshang734.xyz
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 8 of 92 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| ADMINUSLabs | malicious | malicious |
| Chong Lua Dao | malicious | malicious |
| CyRadar | malicious | malicious |
| Lionic | malicious | malicious |
| Viettel Threat Intelligence | malicious | malicious |
| VIPRE | malicious | malware |
| Webroot | malicious | malicious |
| alphaMountain.ai | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| Network | 188.114.96.0/22 |
| AS owner | Cloudflare, Inc. |
| ASN | 13335 |
History
| Last analysis | 2026-05-16 04:44 UTC |
| Last modified on VirusTotal | 2026-05-16 04:46 UTC |
| WHOIS record date | 2026-05-07 01:55 UTC |
domain
1eh2e3taw3g.com
UrlVoid 4 / 35
IOC database
- Type
- domain
- Value
1eh2e3taw3g.com- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to KongTuke
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
- External reference Threatfox IOCs/Threats
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: KongTuke (aliases: TAG-124,js.LandUpdate808). Confidence: 100. First seen: 2026-05-13 17:47:21 UTC. Last seen: 2026-05-13 18:06:03 UTC. Reporter: monitorsg. Tags: Kongtuke.
Remediations (10)
-
web:aviatrix.ai
In November 2025, KongTuke used fake CAPTCHA lures and PowerShell to deploy persistent Python-based malware through compromised sites, evading detection.
-
web:cybersecuritynews.com
A sophisticated new cyberattack chain dubbed " KongTuke " has been uncovered by cybersecurity researchers, targeting unsuspecting internet users through compromised legitimate websites. Detailed in a report by Bradley Duncan of Palo Alto Networks' Unit 42 team, this attack leverages malicious scripts and fake CAPTCHA pages to hijack victims' clipboards and potentially install ...
-
web:isc.sans.edu
Introduction Today's diary is an example of KongTuke activity using fake CAPTCHA pages for a ClickFix -style lure. Also known as LandUpdate808 or TAG-124 and described as a sophisticated TDS system, KongTuke has been active since at least May 2024. I keep track of this campaign through the infosec.exchange Mastodon instance, which is mostly information from the @monitorsg profile. With URLscan ...
-
web:packetwatch.com
The malicious script grabs a payload from a malicious domain . In all cases Team Sixty43 has seen in this recent spike in KongTuke activity, the payload is a tar file - a Havoc C2 demon (C2 implant).
-
web:reliaquest.com
There are three reasons KongTuke likely made the move. Lower friction than email: Email delivery is becoming more difficult for attackers as secure email gateways, domain -authentication enforcement, and impersonation-detection controls continue to raise the bar.
-
web:thedfirreport.com
The DFIR Report researchers have recently seen this same KongTuke web-inject transitioning to a FileFix variant. This updated delivery mechanism has been observed deploying the PHP variant of the Interlock RAT, which in certain cases has then led to the deployment of the Node.js variant of the Interlock RAT.
-
web:threatfox.abuse.ch
KongTuke IOC: 1eh2e3taw3g.com ( domain ) You are viewing the ThreatFox database entry for domain 1eh2e3taw3g.com .
-
web:www.levelblue.com
The KongTuke alias is derived from one of the domain names observed hosting malicious FAKEUPDATES JavaScript payloads . This variant consistently leverages the URL endpoints "/land.php" and "/update.php" within the malware's source code.
-
web:www.msspalert.com
The KongTuke alias is derived from one of the domain names observed hosting malicious FAKEUPDATES JavaScript payloads . This variant consistently leverages the URL endpoints "/land.php" and "/update.php" within the malware's source code. These infrastructures have inspired the LandUpdate808 codename, where "808" serves as an internal naming convention to indicate the origin of ...
-
web:www.trendmicro.com
Our analysis of an active KongTuke campaign deploying modeloRAT — malware capable of reconnaissance, command execution, and persistent access — through compromised WordPress sites and fake CAPTCHA lures shows that the group still operates this delivery chain in parallel with the newer CrashFix technique.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.