The host at this IP address is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse.
Smoke Loader botnet controller located at 45.135.233.190 on port 80 (using HTTP POST):
hXXp://afrocalite.ga/
afrocalite.ga. 600 IN A 45.135.233.190
Referencing malware binaries (MD5 hash):
3d75271eb12cedd6440f8ed22724840c — AV detection: 22 / 69 (31.88)
a60fb5ddab79eb3c2365a5fa15290933 — AV detection: 20 / 68 (29.41)
b63749643d0f1372ca081e9cc42c6225 — AV detection: 56 / 67 (83.58)
eefd6e1c185e49b48591f061e17ef3e1 — AV detection: 35 / 67 (52.24)
f4acf3df4751fb02780274e8c53117a8 — AV detection: 26 / 67 (38.81)
The host at this IP address is obviously operated by cybercriminals. It is running a malware botnet controller which is being used to control infected computers (bots) around the globe using a trojan horse.
Malware botnet controller located at 46.161.41.20 port 443:
$ telnet 46.161.41.20 443
Trying 46.161.41.20…
Connected to 46.161.41.20.
Escape character is ‘^]
Malicious domains observed on this IP address:
afrocalite.ga. 600 IN A 46.161.41.20
clamprite.ga. 600 IN A 46.161.41.20
venis.ml. 600 IN A 46.161.41.20