api.nostr[.]watchDomain
Reported by 1 independent source · first reported by SentinelLabs · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties“Upon first execution, it pulls live Nostr relays from api.nostr[.]watch/v1/online and combines them with a hardcoded relay list belonging to legitimate Nostr services, then searches the relays for an operator’s profile on the Nostr network based on a public profile key given in the…”
Indicators reported together
named in the same reports- registry.hashicorp-aws[.]comin 1 report
- registry.hashicorp-aws[.]ioin 1 report
- registry.hashicorp-terraform[.]ioin 1 report
- 176.97.114[.]232in 1 report
- 45.11.59[.]140in 1 report
- 85.137.56[.]10in 1 report
- grenight[.]comin 1 report
- 85.137.56[.]245in 1 report
- nostr[.]momin 1 report
- relay.snort[.]socialin 1 report
- offchain[.]pubin 1 report
- nostr.oxtr[.]devin 1 report
- nostr[.]winein 1 report
- 1cd6d13ff15adbf7a42025d10ec99b4ain 1 report
- 5728b11d30586bbf…722a06e767a2in 1 report
- 02df07a173ab03b8…fff8b1467f28in 1 report
- c491d477dbe0ae04…144c03f73ec4in 1 report
- technicais.sytes[.]netin 1 report
- storage.hubpage[.]cloudin 1 report
- 4b2d3e8ccce8920a…8b416b731daain 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.