147.45.197[.]92IP address
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 6 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Anthropic Claude Code Leak“…ofiles/76561198721263282Vidar DDR (Dead Drop Resolvers)hxxps://telegram.me/g1n3sssVidar DDRhxxps://rti.cargomanbd.comVidar C2https://147.45.197[.]92:443GhostSocks C2https://94.228.161.88:443GhostSocks C2https://github.com/leaked-claude-code/leaked-claude-codeTrojanized Claude Code…”
-
How Fake OpenClaw Installers Spread GhostSocks Malware“Primary Helper URL: https[://]147.45.197[.]92:443”
Indicators reported together
named in the same reports- 94.228.161[.]88in 2 reports
- socifiapp[.]comin 1 report
- star-history[.]comin 1 report
- 249058ce8dc6e74c…5dceea008139in 1 report
- 0b6ed577b993fd81…184685af7e05in 1 report
- b73bd2e4cb16e903…896797435b82in 1 report
- e13d9304f7ebdab1…ecfebf18b9fdin 1 report
- 518ff5fbfa4296ab…5175fb70e2b3in 1 report
- f03e38e1c39ac521…f340523b4b51in 1 report
- 40fc240febf2441d…de38e266b378in 1 report
- 185.196.9[.]98in 1 report
- serverconect[.]ccin 1 report
- fd67063ffb0bcde4…1a0894f12690in 1 report
- d5dffba463beae20…d819a1809846in 1 report
- a22ddb3083b62dae…5c8908740ed5in 1 report
- 121.127.33[.]212in 1 report
- 144.31.123[.]157in 1 report
- 144.31.139[.]201in 1 report
- 144.31.139[.]203in 1 report
- 144.31.204[.]136in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.