149.28.124[.]84IP address
Reported by 1 independent source · first reported by Sekoia.io · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Supply Chain Attack Against Chrome Browser Extensions“All domain names used as C2 server for hosting the configuration file were hosted at 149.28.124[.]84 or 45.76.225.148 (AS 20473, VULTR).”
Indicators reported together
named in the same reports- chromeforextension[.]comin 1 report
- supportchromestore[.]comin 1 report
- hxxps://app.checkpolicy[.]site/extension-privacy-policy?e=[email redacted]in 1 report
- app.checkpolicy[.]sitein 1 report
- hxxps://app.checkpolicy[.]site/accept-terms-policy?e=[email redacted]in 1 report
- 2024proxyswitchyomega[.]proin 1 report
- 2024graphqlnetwork[.]proin 1 report
- 2024yescaptcha[.]proin 1 report
- 2024castorus[.]infoin 1 report
- 2024uvoice[.]livein 1 report
- 2024videodownloadhelper[.]proin 1 report
- 2024parrottalks[.]infoin 1 report
- 2024bookmarkfc[.]infoin 1 report
- 2024internxtvpn[.]proin 1 report
- 2024vidnozflex[.]livein 1 report
- 2024cyberhavenext[.]proin 1 report
- 2024wayinai[.]livein 1 report
- 2024readermodeext[.]infoin 1 report
- 2024primusext[.]proin 1 report
- 2024tinamind[.]infoin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.