The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse.
Smoke Loader botnet controller located at 95.213.216.234 on port 80 (using HTTP POST):
hXXp://afrocalite.ga/
afrocalite.ga. 600 IN A 95.213.216.234
Referencing malware binaries (MD5 hash):
3d75271eb12cedd6440f8ed22724840c — AV detection: 22 / 69 (31.88)
a60fb5ddab79eb3c2365a5fa15290933 — AV detection: 20 / 68 (29.41)
b63749643d0f1372ca081e9cc42c6225 — AV detection: 56 / 67 (83.58)
eefd6e1c185e49b48591f061e17ef3e1 — AV detection: 35 / 67 (52.24)
f4acf3df4751fb02780274e8c53117a8 — AV detection: 26 / 67 (38.81)
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse.
Malware botnet controller located at 95.213.216.234 port 443:
$ telnet 95.213.216.234 443
Trying 95.213.216.234…
Connected to 95.213.216.234.
Escape character is ‘^]
Malicious domains observed on this IP address:
afrocalite.ga. 600 IN A 95.213.216.234
clamprite.ga. 600 IN A 95.213.216.234
gadafict.pw. 600 IN A 95.213.216.234
oxfordbames.com. 600 IN A 95.213.216.234
venis.ml. 600 IN A 95.213.216.234