rti.cargomanbd[.]comDomain
Reported by 1 independent source · first reported by Trend Micro Research · last reported
Last reported 6 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Claude Code Packaging Error Remains a Lure in an Active Campaign: What Defenders Should Do“eventSubId:204 AND dst:("rti.cargomanbd[.]com")”
-
Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads“eventSubId:204 AND dst:("rti.cargomanbd[.]com")”
Indicators reported together
named in the same reports- cli.js[.]mapin 1 report
- snippet[.]hostin 1 report
- hxxps://github[.]com/leaked-claude-code/leaked-claude-codein 1 report
- hxxps://github[.]com/leaked-claude-code/leaked-claude-code/releases/download/leaked-claude-code/Claude_code_x64.7zin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.