149.154.164[.]13IP address
Reported by 1 independent source · first reported by Trend Micro Research · last reported
Last reported 7 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Through the Lens of MDR: Analysis of KongTuke’s ClickFix Abuse of Compromised WordPress Sites“…s.py) initiated repeated outbound connections to external IPs (158.247.252.178:80 and 170.168.103.208:80) and an HTTPS connection to 149.154.164[.]13 (associated with Telegram infrastructure), indicating likely C&C communication with both direct IP-based endpoints and a Telegram-ba…”
Indicators reported together
named in the same reports- hxxps://ainttby[.]com/6f54.jsin 1 report
- ainttby[.]comin 1 report
- hxxps://ctpsih[.]com/2d5h.jsin 1 report
- ctpsih[.]comin 1 report
- hxxps://foodgefy[.]com/6o0jk.jsin 1 report
- foodgefy[.]comin 1 report
- 162.33.178[.]171in 1 report
- hxxp://45.61.138[.]224/nin 1 report
- 45.61.138[.]224in 1 report
- hxxps://www.dropbox[.]com/scl/fi/np4h0kexqq5r9vlpzwg4d/rp?rlkey=fwg1koexylntccobyxaliju7w&st=3wxzp44k&dl=1in 1 report
- 158.247.252[.]178in 1 report
- 170.168.103[.]208in 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.