123but.com
Classification: Malicious
123but.com is a malicious hostname. Linked to Remcos malware. Reported by ThreatFox Abuse.ch, last seen 2026-09-30. Resolves to 172.64.80.1 and 6 more.
Current activity
- Online — resolving/reachable. Last checked 2026-10-18 04:39:56.
- Command & Control server — Used by cybercriminals to control victim computers.
MITRE ATT&CK associations
Malware families: REMCOS (S0332)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Remcos | ThreatFox Abuse.ch | 2026-09-30 18:04:54 | 2026-09-30 18:25:07 | botnet malicious-activity | S0332 Remcos |
Tags
remcos remcosrat remvio socmerIP addresses resolved by this hostname
- 172.64.80.1 (2026-10-07 04:39:13)
- 2606:4700:130:436c:6f75:6466:6c61:7265 (2026-10-08 20:38:43)
- 104.21.51.234 (2026-10-10 08:40:50)
- 2606:4700:3033::ac43:bf84 (2026-10-10 08:40:50)
- 172.67.191.132 (2026-10-10 08:40:50)
- 2606:4700:3036::6815:33ea (2026-10-10 08:40:50)
- 180.93.115.56 (2026-10-18 04:39:56)
Whois information
- Domain
- 123but.com
- TLD
- com
- DNSSEC
- ['unsigned']
- Nameservers
- KRISTIN.NS.CLOUDFLARE.COM, PETE.NS.CLOUDFLARE.COM
- Registrant
- GoDaddy.com, LLC
- Contact email
- [email protected]
- Domain created
- 2026-09-14 11:21:31
- Domain expires
- 2027-09-14 11:21:31
- First indexed
- 2026-09-30 18:25:07
- Last updated
- 2026-10-18 04:39:56