142.11.206[.]73IP address
Reported by 4 independent sources · first reported by Trend Micro Research · last reported
Last reported 6 months ago
What the reports say
5 reports, newest first · the exact sentence from each-
Supply Chain Attacks Surge in March 2026“…ngrade to axios@1.14.0 (for 1.x users) or axios@0.30.3 (for 0.x users) and update lockfiles.Search for connections to sfrclak.com or 142.11.206[.]73 from developer workstations and CI/CD systems.Use private registry proxies and Software Composition Analysis (SCA) tools to filter an…”
-
Elastic releases detections for the Axios supply chain compromise“| C2 IP | 142.11.206[.]73 |”
-
Inside the Axios supply chain compromise - one RAT to rule them all“| 142.11.206[.]73 | ipv4-addr | | C2 |”
-
Supply Chain Compromise of axios npm Package“Check network/DNS logs for connections to sfrclak.com or 142.11.206[.]73 on port 8000.”
-
Axios NPM Package Compromised: Supply Chain Attack Hits JavaScript HTTP Client with 100M+ Weekly Downloads“eventSubId:204 AND dst:("sfrclak.com" OR "142.11.206[.]73")”
Indicators reported together
named in the same reports- sfrclak[.]comin 5 reports
- packages.npm[.]orgin 4 reports
- 92ff08773995ebc8…071230c9645ain 4 reports
- d6f3f62fd3b9f543…fd5247d5ee71in 3 reports
- 07d889e2dadce6f3…7d28ca61c766in 3 reports
- 617b67a8e1210e4f…f583c900d101in 3 reports
- fcb81618bb15edfd…02bf980375cfin 3 reports
- hxxp://sfrclak[.]com:8000/6202033in 3 reports
- hxxp://sfrclak[.]com:8000/in 2 reports
- callnrwise[.]comin 2 reports
- 2553649f23220496…d0d6adc700cain 2 reports
- e10b1fa84f1d6481…4d894c2e0e09in 2 reports
- ed8560c1ac7ceb69…96637d5f815cin 2 reports
- f7d335205b8d7b20…f4e7d07121cdin 2 reports
- com[.]applein 1 report
- 591a70e8b1662658…51c5cd9b1655in 1 report
- calltan[.]comin 1 report
- hxxps://gist.github[.]com/JohnHammond/df0e06df00e993e7917436d0f73df626in 1 report
- hxxps://gist.github[.]com/JohnHammond/96575799bd87ae64cddbc55634a6d32din 1 report
- npm[.]orgin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.