download-version.1-5-8[.]comDomain
Reported by 1 independent source · first reported by Trend Micro Research · last reported
Last reported 5 months ago
What the reports say
1 report, newest first · the exact sentence from each-
InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise“…l on an endpoint invoked mshta.exe to download and execute a malicious payload (claude.msixbundle) from known malicious domain download-version.1-5-8[.]com.”
Indicators reported together
named in the same reports- hxxps://$nipple.oakenfjrod[.]ru/cloude-91267b64-989f-49b4-89b4-984e0154d4d1in 1 report
- $nipple.oakenfjrod[.]ruin 1 report
- oakenfjrod[.]ruin 1 report
- 811fbf0ff6b6acab…0dd0178a0302in 1 report
- 2f04ba77bb841111…48d4495b5f74in 1 report
- 104.21.0[.]95in 1 report
- 185.177.239[.]255in 1 report
- 77.91.97[.]244in 1 report
- hosted-by.yeezyhost[.]netin 1 report
- 1-5-8[.]comin 1 report
- get-version[.]comin 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.