vmheaven[.]ioDomain
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 5 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Komari Red: The Monitoring Tool with a Built-in Reverse Shell“Initial access was a single SSLVPN session from 45.153.34.132 (VMHeaven[.]io / AS 51396) authenticated as [User 1], handed an internal tunnel IP of 10.212.134.200.”
Indicators reported together
named in the same reports- 45.153.34[.]132in 1 report
- komari-document.pages[.]devin 1 report
- 039e659ade3aa8ee…a2042f6d584cin 1 report
- hxxps://raw.githubusercontent[.]com/komari-monitor/komari-agent/refs/heads/main/install.ps1in 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.