claude.ai.download-app[.]usDomain

Reported by 1 independent source · first reported 22 Jul 2026 by Huntress · last reported 22 Jul 2026

Last reported 3 months ago

What the reports say

1 report, newest first · the exact sentence from each

“Specifically, they are sent to claude.ai.download-app[.]us (registered May 9, 2026) and subsequently to downloading-api.it.com/html/claude/win.”

HuntressVendor22 Jul 2026
Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT

Indicators reported together

named in the same reports

2.24.131[.]246in 1 report
download-app[.]usin 1 report
polse[.]usin 1 report
5ca8758c-02d0-4a72-89c8-d468b66dda41[.]comin 1 report
1cd58cfba596da29…c53563f4e3bbin 1 report
26bae4d7012bf598…2c6d0d21394ain 1 report
1fe3646d27d286db…c28869a91664in 1 report
f8acb8f5cf88b77a…47d818da3ed0in 1 report
fd826215add30c13…fe8a88de7939in 1 report
107.189.24[.]67in 1 report
104.194.133[.]210in 1 report
107.189.26[.]86in 1 report
107.189.21[.]86in 1 report
45.59.124[.]17in 1 report
45.59.125[.]228in 1 report
45.59.122[.]82in 1 report
107.189.17[.]143in 1 report
45.59.122[.]134in 1 report
45.59.122[.]235in 1 report
107.189.22[.]118in 1 report

Copy these 20 indicators · defanged

20 indicators, defanged, one per line

2.24.131[.]246
download-app[.]us
polse[.]us
5ca8758c-02d0-4a72-89c8-d468b66dda41[.]com
1cd58cfba596da296ab1878d74023e00c399345a1b6c2a0e5446c53563f4e3bb
26bae4d7012bf59847ab4036a065419c3d4ca47e020479f55b3b2c6d0d21394a
1fe3646d27d286db8123297e06ae7badf3e26f352a04f91b6d82c28869a91664
f8acb8f5cf88b77a4c27d7fd6856aa299bb178e85f9963c2fbd447d818da3ed0
fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939
107.189.24[.]67
104.194.133[.]210
107.189.26[.]86
107.189.21[.]86
45.59.124[.]17
45.59.125[.]228
45.59.122[.]82
107.189.17[.]143
45.59.122[.]134
45.59.122[.]235
107.189.22[.]118

Thanks — we review every report.

Report a wrong value