aomei.storage-data[.]comDomain
Reported by 3 independent sources · first reported by Google Threat Intelligence · last reported
Last reported 5 days ago
What the reports say
3 reports, newest first · the exact sentence from each-
AOMEI Backupper update servers hijacked to push malware: Check your PC“If you’re seeing outgoing traffic to promotion.storage-data.com, aomei.storage-data[.]com, storage-data.com, 8.210.84.56, 47.239.60.117, or 8.218.65.184, whether blocked or allowed.”
-
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor“Domain: storage-data.com, promotion.storage-data.com, aomei.storage-data[.]com”
-
Investigating Ephemeral Supply Chain Tampering“…uly 1–7, 2026): The threat actor transitioned to dedicated, vendor-themed domains (storage-data.com, promotion.storage-data.com, aomei.storage-data[.]com).”
Indicators reported together
named in the same reports- 8.210.84[.]56in 3 reports
- promotion.storage-data[.]comin 3 reports
- storage-data[.]comin 3 reports
- 8.218.65[.]184in 3 reports
- 47.239.60[.]117in 3 reports
- checkip.amazonaws[.]comin 1 report
- hxxps://www2.aomeisoftware[.]com/download/abpopup/down_html.iniin 1 report
- www2.aomeisoftware[.]comin 1 report
- hxxps://account.aomeitech[.]com/Notifycfg.iniin 1 report
- account.aomeitech[.]comin 1 report
- hxxps://www2.aomeisoftware[.]com/download/abpopup/upgrade-now.zipin 1 report
- hxxps://promotion.storage-data[.]com/download/abpopup/upgrade-now.zipin 1 report
- ee89c99f3753231771170f5d9cbbae1ein 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.