143.244.47[.]67IP address
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 18 months ago
What the reports say
1 report, newest first · the exact sentence from each-
CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation“Notably, two different IP addresses were seen in the CrushFTP logs, including 146.70.166.201 used for uploading storm.exe and 143.244.47[.]67 for deleting storm.exe and then for uploading mx.exe.”
Indicators reported together
named in the same reports- 2.58.56[.]16in 1 report
- 172.235.144[.]67in 1 report
- 114c196c39c91575880a5012d06565b1in 1 report
- 1ab5a915e306686a1c7bebd03563a977in 1 report
- 85a1bfebf2a5973e…e902924c347ein 1 report
- f7c8be827f3bd98b…fc1971751ff7in 1 report
- be6cb5f80b33b9e9…ae5969bcfc0ein 1 report
- hxxps://1212.requestcatcher[.]com/in 1 report
- 1212.requestcatcher[.]comin 1 report
- 146.70.166[.]201in 1 report
- 9036c92c3ca73cb6…11873ad7e281in 1 report
- ee6d24410a8cf31d…f607b1dc0be3in 1 report
- 0b8e76eb315bc522…0cfc89d84f69in 1 report
- hxxps://www.crushftp[.]com/crush11wiki/Wiki.jsp?page=Updatein 1 report
- www.crushftp[.]comin 1 report
- hxxps://outpost24[.]com/blog/crushftp-auth-bypass-vulnerability/in 1 report
- outpost24[.]comin 1 report
- hxxps://attackerkb[.]com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysisin 1 report
Copy these 18 indicators · defanged
Also named with it: CVE-2025-31161, CVE-2025-2825
Thanks — we review every report.