medium
advisory
NetSupportManager RAT Infrastructure Indicators
Abuse.ch has identified 18 new command and control indicators, including 17 IP addresses and one domain, associated with the NetSupportManager remote access trojan.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 5, 13:38 UTC
- Detection
- 18 IOCs
- Source quality
- A1Very likely
ThreatFox has published 18 newly observed command and control (C2) indicators associated with the NetSupportManager RAT, a remote access tool frequently abused by threat actors for unauthorized system access. These indicators were confirmed active as of November 4, 2026.
Recommendation
- Block the domain 'agreement-rc.com' at the enterprise DNS resolver.
- Implement egress traffic blocking for the identified C2 IP addresses at the perimeter firewall.
- Review network logs for historical connections to these indicators to identify potential prior compromise.
Immediate actions
Block listed IP addresses and domain on perimeter firewalls and DNS resolvers
SOC
4h
Threat Hunt
Identify endpoints communicating with the listed C2 infrastructure
T1071.001
high
high confidence
hunt now
Data: Network proxy logs, DNS request logs, Firewall traffic logs
Indicators of compromise
1
domain
17
ip
| Type | Value |
|---|---|
| ip | 95.85.246.222 |
| ip | 94.181.203.45 |
| ip | 89.105.217.188 |
| ip | 85.239.144.93 |
| ip | 77.105.141.234 |
| ip | 62.164.177.248 |
| ip | 5.253.59.121 |
| ip | 5.252.155.120 |
| ip | 193.143.1.21 |
| ip | 176.65.144.140 |
| ip | 176.65.144.133 |
| ip | 162.33.179.223 |
| ip | 162.19.130.138 |
| ip | 151.243.18.118 |
| ip | 144.76.188.73 |
| ip | 108.61.198.38 |
| ip | 93.232.110.114 |
| domain | agreement-rc.com |