107.189.24[.]67IP address
Reported by 2 independent sources · first reported by Elastic Security Labs · last reported
Last reported 3 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT“107.189.24[.]67”
-
A Wretch Client: From ClickFix deception to information stealer deployment“| 107.189.24[.]67 | 2025-06-02 | 2025-06-15 |”
Indicators reported together
named in the same reports- claude.ai.download-app[.]usin 1 report
- 2.24.131[.]246in 1 report
- download-app[.]usin 1 report
- polse[.]usin 1 report
- 5ca8758c-02d0-4a72-89c8-d468b66dda41[.]comin 1 report
- 1cd58cfba596da29…c53563f4e3bbin 1 report
- 26bae4d7012bf598…2c6d0d21394ain 1 report
- 1fe3646d27d286db…c28869a91664in 1 report
- f8acb8f5cf88b77a…47d818da3ed0in 1 report
- fd826215add30c13…fe8a88de7939in 1 report
- 104.194.133[.]210in 1 report
- 107.189.26[.]86in 1 report
- 107.189.21[.]86in 1 report
- 45.59.124[.]17in 1 report
- 45.59.125[.]228in 1 report
- 45.59.122[.]82in 1 report
- 107.189.17[.]143in 1 report
- 45.59.122[.]134in 1 report
- 45.59.122[.]235in 1 report
- 107.189.22[.]118in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.