update-trellix[.]comDomain
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 3 months ago
What the reports say
1 report, newest first · the exact sentence from each-
JadeProx: Tracing a China-nexus Operation Through an OPSEC Mistake“It has the identical triad payloads, but no VBS or shortcut is seen in the installation sequence and a different C2, update-trellix[.]com that resolved to 192.252.186.62 communicating on port 8080.”
Indicators reported together
named in the same reports- 43.106.71[.]28in 1 report
- hxxps://github[.]com/serjs/socks5-serverin 1 report
- hxxps://github[.]com/xmrig/xmrig-proxyin 1 report
- photo.pokok.edu[.]hkin 1 report
- pta.sfaeps.edu[.]hkin 1 report
- sylverixstrategy[.]comin 1 report
- gouvvbo[.]topin 1 report
- 853f760f76de3201b0af0e41f1f65fbain 1 report
- e067ffea77875ae0dc13d4ce045931d3in 1 report
- 8.217.190[.]58in 1 report
- claude-pro[.]comin 1 report
- license.claude-pro[.]comin 1 report
- 192.252.186[.]62in 1 report
- 104.21.60[.]96in 1 report
- 161.35.236[.]255in 1 report
- vertextrust-advisors[.]comin 1 report
Copy these 16 indicators · defanged
Also named with it: CVE-2018-11511, CVE-2021-31755, CVE-2021-32305, CVE-2021-24139
Thanks — we review every report.