rtb.mftadsrvr[.]comDomain
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 17 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Do Tigers Really Change Their Stripes?“…involved the threat actor installing Mesh Agent, installed from the C:\Windows\Temp folder, and configured to connect to https[://]rtb.mftadsrvr[.]com:2087.”
-
CVE-2025-30406: Gladinet CentreStack & Triofox Exploited“The MeshCentral agent connects to rtb.mftadsrvr[.]com, with the same IP as the Centre.exe connection.”
Indicators reported together
named in the same reports- 2.58.56[.]16in 2 reports
- 196.251.85[.]31in 1 report
- hxxps://gladinetsupport.s3.us-east-1.amazonaws[.]com/gladinet/securityadvisory-cve-2005.pdfin 1 report
- gladinetsupport.s3.us-east-1.amazonaws[.]comin 1 report
- hxxps://gladinetsupport.s3.us-east-1.amazonaws[.]com/gladinet/securityadvisory-cve-2025-triofox.pdfin 1 report
- hxxp://redacted.oastify[.]com/REDACTEDin 1 report
- redacted.oastify[.]comin 1 report
- hxxp://redacted.oast[.]funin 1 report
- redacted.oast[.]funin 1 report
- 104.21.16[.]1in 1 report
- 104.21.48[.]1in 1 report
- 48b006cb17e75ecd…abca1c5fabbfin 1 report
- 30981d4082b58704…26aef21e75c2in 1 report
- 165.227.7[.]206in 1 report
- 45.84.107[.]76in 1 report
Copy these 15 indicators · defanged
Also named with it: CVE-2025-31161, CVE-2025-30406
Thanks — we review every report.