node-js.prentiva99[.]infoDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Lost in relocation: analysis of a new loader distributing CASTLESTEALER“The infection began when the user searched for an lts version of node.js and clicked a sponsored result leading to node-js.prentiva99[.]info, a malicious landing page designed to impersonate a legitimate Node.js deployment platform.”
Indicators reported together
named in the same reports- app.miloyannopoulos[.]comin 1 report
- rohitab[.]comin 1 report
- 6e0a1f8f77f7011561f6f9ca96b71b8fin 1 report
- 956c6128e9362e075f8d006c93616a66in 1 report
- hxxps://link.storjshare[.]io/raw/jv5uebuqwzfpmtahj34q753ptykq/node/BATPackageBulderSetup.batin 1 report
- link.storjshare[.]ioin 1 report
- hxxps://link.storjshare[.]io/raw/jvsmdybqmvwep2oawbobp6ub7aza/node/node-v24.15.0-x64-86.exein 1 report
- fdfc7831e5c24cfa…18ed974eda37in 1 report
- de4f51649ec1a330…6dd5dfef2615in 1 report
- 9a9939dff2979977…3d09b7e6c28din 1 report
- c85f2765a6c3c3f3…f50666d065fein 1 report
- 4ec9d9d4d10ad78f…f152313b9741in 1 report
- 39019279686c820c…0577ace5b5c6in 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.