131.123.40[.]98IP address
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity“That MSI file deployed a ScreenConnect client, which was configured to communicate with 131.123.40[.]98 on port 8041.”
Indicators reported together
named in the same reports- hxxps://www.connectwise[.]com/company/trust/advisoriesin 1 report
- www.connectwise[.]comin 1 report
- 45.13.237[.]190in 1 report
- tele-sync.opik[.]netin 1 report
- 15.204.185[.]204in 1 report
- 146.59.55[.]107in 1 report
- 45.32.192[.]150in 1 report
- borertors92.anondns[.]netin 1 report
- hxxp://url[.]com/combo.encin 1 report
- url[.]comin 1 report
- homehub.opik[.]netin 1 report
- 08bc4e82883eb42f…2a64f6cc9020in 1 report
- de3b6836a88ae4b1…fcac4089a457in 1 report
- 19a3534da9f60c72…ef08117f3260in 1 report
- 110fffc85370bb7c…becaa3a41d66in 1 report
- de89d560fc8302c7…7eedcbd2aedein 1 report
- ffd6d23f579571cc…f53c3688a0dein 1 report
Copy these 17 indicators · defanged
Also named with it: CVE-2026-84869
Thanks — we review every report.