Silver Fox Malware: Top 10 Malicious Domains and IPs (Part 5)
The China Internet Cybersecurity Threat Governance Alliance listed 10 Silver Fox command-and-control assets with daily control scales from 832 to 6,549. Most of the IP addresses are attributed to Hong Kong, China, and several use Microsoft lookalike domains on port 443.
On 24 September 2026, the China Internet Cybersecurity Threat Governance Alliance (CCTGA) published a further set of malicious network assets used by the Silver Fox malware operation. This installment lists the top 10 assets by recent control scale. Most are attributed to Hong Kong, China.
Silver Fox campaign
CCTGA is running a special campaign against Silver Fox. Stated tasks include disruption of control infrastructure, handling of infected endpoints, governance of malware distribution chains, outcome assessment, and mechanism improvement.
The group is also known as YouShe and Gu Duo Da Dao. It distributes remote-access trojans through fake software download sites, malicious search-engine promotion, phishing email, and instant messaging. Families named in the notice include Gh0st, Win0s, and DcRat. Cited functions include file delivery, process management, command execution, screen monitoring, keystroke logging, and theft of sensitive information.
Top 10 malicious assets
CCTGA confirmed the following assets. Daily control scale is the figure given in the notice.
1. IP 177.4.3.99, port 443, Hong Kong, China, daily control scale 6,549. Related domains: 11x.mlcrosoft.vip, c72.mlcrosoft.my, local82.mlcrosoft.my, 54.mlcro.net, local7.mlcrosoft.my, local72.mlcrosoft.my, local8.mlcrosoft.my, localx.mlcrosoft.my, 28.mlcro.net, 10.mlcrosoft.vip.
2. IP 177.4.3.35, port 443, Hong Kong, China, daily control scale 6,161. Related domains: 18.mlcro.net, 23.mlcro.net.
3. IP 177.4.3.101, port 443, Hong Kong, China, daily control scale 4,153. Related domains: 21.mlcro.net, 19.mlcro.net, 20.mlcro.net.
4. IP 177.4.3.97, port 443, Hong Kong, China, daily control scale 3,607. Related domains: 21.mlcro.net, 22.mlcro.net, 28.mlcro.net, 54.mlcro.net.
5. IP 177.4.3.62, port 443, Hong Kong, China, daily control scale 3,538. Related domains: otaku.mlcrosoft.vip, biobreak.mlcrosoft.vip, biografias.mlcrosoft.vip, biologitopibiru.mlcrosoft.vip, bionic925.mlcrosoft.vip, bioquimicamarzo-julio.mlcrosoft.vip, birchhill.mlcrosoft.vip, biresim.mlcrosoft.vip, birohumas.mlcrosoft.vip.
6. IP 177.4.3.105, port 443, Hong Kong, China, daily control scale 3,524. Related domains: bisnispulsaelektrik.mlcrosoft.vip, 888zhenrenhuipianren.mlcrosoft.vip, 0.mlcrosoft.vip, www.0.mlcrosoft.vip, 000kkk.mlcrosoft.vip, 007a.mlcrosoft.vip.
7. IP 47.242.177.24, port 45, Hong Kong, China (CDN), daily control scale 2,051. Related domains: ab.0orrw5re.com, sl.fo8kdhrj.com, gtq.kmnx23dgf3.com, xat.tk9885.com, zu.cmsiss.icu, dan.92ewi29wmjyrjlpg.com.
8. IP 148.66.11.18, port 5178, Hong Kong, China, daily control scale 1,001. Related domain: rsoxq1lsqdf3fcmdug6exhguj43q9999.telawsuk5redsianxq1omiq9.claudfront.net.
9. IP 47.242.106.7, port 7089, Hong Kong, China (CDN), daily control scale 891. Related domains: aceqqj.net, cavuax.net, dyfmkr.net, gnkygm.net, ikhhya.net.
10. IP 137.220.136.168, port 5178, Hong Kong, China, daily control scale 832. Related domain: gadad.bvndjx.cn.
Defensive actions
CCTGA advises organizations to add the indicators of compromise to threat-intelligence platforms, network egress controls, and endpoint protection so the listed domains, IP addresses, and malware files can be detected and blocked.
Confirmed infected endpoints should be isolated from the network. Malicious files and persistence mechanisms should be removed, and other abnormal programs and network communications should be checked.
CCTGA also advises against downloading software from unofficial channels and against opening links or files from unknown sources. Related clues and samples can be sent to silverfox@cert.org.cn.
High-level checks include recent browser history, DNS requests, and network traffic for visits to related phishing sites, malicious domains, and IP addresses, plus recent downloads, unusual processes, startup items, and network connections. Internal hunting can use malware file hashes and communication addresses to find other affected endpoints.