195.226.92.129:20911
ip C2Tracked by C2 Tracker · Updated as of 2026-10-10 · Whois queried 2026-10-10T14:04:05
Network
- Network
- LLC-VEKTOR-AITI-TEKHNOLOGII
- CIDR
- 195.226.92.0/24
- Country
- FI
Contact
- Handle
- 195.226.92.0 - 195.226.92.255
- Abuse
- ripe@interlir.com
Observed in malware
| Family | Sample SHA-256 | Role | First seen |
|---|---|---|---|
| SpyMax (provisional) | 033b60ace95e… | C2 | 2026-05-22 |
About SpyMax (provisional)
**SpyMax (provisional)** is a commercial Android spyware/RAT of the SpyNote family (SpyMax lineage), built from a public builder and repackaged under game and utility lures (for example "Proxy hs" and "Google Translate") with randomised package and class names per build. The C2 is stored as base64 static fields initializeService.ClientHost and ClientPort (decoded at runtime by a Base64 helper) and reached as a raw TCP socket to ClientHost:ClientPort; builds also carry a ConnectionKey. It runs a full surveillance stack: live screen streaming via MediaProjection (Screen_Sender / SecondarySocket), live camera capture (CameraHandler socket), keylogging (KeyboardService), an Accessibility service (AccessService), a FloatingView overlay, geolocation (LocationService plus Yandex static-maps), SMS theft and app installation (REQUEST_INSTALL_PACKAGES). Some builds ship a LAN/test C2 (for example 192.168.18.46) left by the operator or a red-teamer. Family label provisional.
Signing certificate
- Subject CN
- Android Debug
- Issuer CN
- Android Debug
- Valid
- 2016-10-23 → 2044-03-10
- Fingerprint
- 1e08a903aef9c3a721510b64ec764d01d3d094eb954161b62544ea8f187b5953
Other samples signed with this certificate? That's a lead worth checking - but not proof of a shared operator, since signing keys (and the Android debug certificate in particular) are widely reused. See the certificate page for every sample signed with it.