TF-1811902
high
📛 Threat Title
KongTuke: URL that delivers a malware payload https://1eh2e3taw3g.com/d
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: KongTuke (aliases: TAG-124,js.LandUpdate808). Confidence: 100. First seen: 2026-05-13 17:47:20 UTC. Last seen: 2026-05-13 18:06:02 UTC. Reporter: monitorsg. Tags: Kongtuke.
Indicators of Compromise (5)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
ipv4
188.114.96.2
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/188.114.96.2
IOC database
- Type
- ipv4
- Value
188.114.96.2- First seen
- Last seen
- Attached to this threat
- Appears in
- 44 threats
- Description
- Resolved from domain xisabarajeonventures.click
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/188.114.96.2
ipv4
188.114.97.2
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/188.114.97.2
IOC database
- Type
- ipv4
- Value
188.114.97.2- First seen
- Last seen
- Attached to this threat
- Appears in
- 44 threats
- Description
- Resolved from domain xisabarajeonventures.click
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/ip_addresses/188.114.97.2
ipv4
188.114.96.3
VT 0 / 92
IOC database
- Type
- ipv4
- Value
188.114.96.3- First seen
- Last seen
- Attached to this threat
- Appears in
- 105 threats
- Description
- Resolved from domain xingshang734.xyz
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
Basic Properties
| Network | 188.114.96.0/22 |
| AS owner | Cloudflare, Inc. |
| ASN | 13335 |
History
| Last analysis | 2026-05-16 04:56 UTC |
| Last modified on VirusTotal | 2026-05-16 04:57 UTC |
| WHOIS record date | 2026-05-07 15:07 UTC |
ipv4
188.114.97.3
VT 8 / 92
IOC database
- Type
- ipv4
- Value
188.114.97.3- First seen
- Last seen
- Attached to this threat
- Appears in
- 105 threats
- Description
- Resolved from domain xingshang734.xyz
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 8 of 92 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| ADMINUSLabs | malicious | malicious |
| Chong Lua Dao | malicious | malicious |
| CyRadar | malicious | malicious |
| Lionic | malicious | malicious |
| Viettel Threat Intelligence | malicious | malicious |
| VIPRE | malicious | malware |
| Webroot | malicious | malicious |
| alphaMountain.ai | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| Network | 188.114.96.0/22 |
| AS owner | Cloudflare, Inc. |
| ASN | 13335 |
History
| Last analysis | 2026-05-16 04:44 UTC |
| Last modified on VirusTotal | 2026-05-16 04:46 UTC |
| WHOIS record date | 2026-05-07 01:55 UTC |
url
https://1eh2e3taw3g.com/d
VT: VT base fetch failed: HTTPError: 429 Too Many Requests for urls/aHR0cHM6Ly8xZWgyZTN0YXczZy5jb20vZA
UrlVoid 4 / 35
IOC database
- Type
- url
- Value
https://1eh2e3taw3g.com/d- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- URL that delivers a malware payload attributed to KongTuke
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for urls/aHR0cHM6Ly8xZWgyZTN0YXczZy5jb20vZA
References (3)
- External reference Threatfox IOCs/Threats
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: KongTuke (aliases: TAG-124,js.LandUpdate808). Confidence: 100. First seen: 2026-05-13 17:47:20 UTC. Last seen: 2026-05-13 18:06:02 UTC. Reporter: monitorsg. Tags: Kongtuke.
Remediations (10)
-
web:aviatrix.ai
In November 2025, KongTuke used fake CAPTCHA lures and PowerShell to deploy persistent Python-based malware through compromised sites, evading detection.
-
web:community.gurucul.com
The attack chain begins with a malicious script injected into legitimate but compromised websites. This script redirects users to a fake CAPTCHA page designed to mimic a "verify you are human" check. The deceptive CAPTCHA page performs clipboard hijacking—also known as pastejacking—by injecting malicious code into the user's clipboard.
-
web:csopakistan.com
Security researchers detail KongTuke's CrashFix campaign, which used fake browser crash pages and a cloned uBlock extension to deploy ModeloRAT through social engineering tactics.
-
web:cybersecuritynews.com
A sophisticated new cyberattack chain dubbed " KongTuke " has been uncovered by cybersecurity researchers, targeting unsuspecting internet users through compromised legitimate websites. Detailed in a report by Bradley Duncan of Palo Alto Networks' Unit 42 team, this attack leverages malicious scripts and fake CAPTCHA pages to hijack victims' clipboards and potentially install ...
-
web:thehackernews.com
Researchers uncovered a CrashFix campaign where a fake Chrome ad blocker crashes browsers to trick users into installing the ModeloRAT malware .
-
web:undercodetesting.com
A recent campaign discovered by Palo Alto Networks Unit 42 involves the KongTuke script being injected into legitimate but compromised websites. This attack leads users to fake CAPTCHA-style pages that perform clipboard hijacking (pastejacking), tricking victims into pasting malicious scripts into a Run window.
-
web:www.csoonline.com
The activity, attributed to a threat cluster Huntress calls KongTuke , involves a fake Chrome extension posing as an ad-blocking tool but ultimately delivering a novel malware payload .
-
web:www.huntress.com
Fake ad blocker crashes your browser, then offers a "fix." Go inside KongTuke's CrashFix campaign, from malicious extension to ModeloRAT for VIP targets.
-
web:www.linkedin.com
A newly discovered cyberattack campaign known as KongTuke is raising serious concerns in the cybersecurity community. Uncovered by Bradley Duncan from Palo Alto Networks' Unit 42, this ...
-
web:www.trendmicro.com
Our analysis of an active KongTuke campaign deploying modeloRAT — malware capable of reconnaissance, command execution, and persistent access — through compromised WordPress sites and fake CAPTCHA lures shows that the group still operates this delivery chain in parallel with the newer CrashFix technique.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.