cs2.ip.thc[.]orgDomain
Reported by 1 independent source · first reported by The DFIR Report · last reported
Last reported 6 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Bissa Scanner Exposed: AI-Assisted Mass Exploitation and Credential Harvesting“These files show the operator obtaining target feeds from ZIP archives hosted on cs2.ip.thc[.]org, assigning the cve_2025_55182 module, and deploying a payload intended to enumerate .env files, cloud metadata, Kubernetes service account context, local credential stores, database an…”
Indicators reported together
named in the same reports- denemekulubum.com[.]trin 1 report
- wiprz[.]comin 1 report
- hxxps://s3.filebase[.]comin 1 report
- s3.filebase[.]comin 1 report
Copy these 4 indicators · defanged
Also named with it: CVE-2025-55182, CVE-2025-9501
Thanks — we review every report.