158.247.252[.]178IP address
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 7 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Through the Lens of MDR: Analysis of KongTuke’s ClickFix Abuse of Compromised WordPress Sites“Subsequently, this Python-based process (pythonw.exe executing modes.py) initiated repeated outbound connections to external IPs (158.247.252[.]178:80 and 170.168.103.208:80) and an HTTPS connection to 149.154.164.13 (associated with Telegram infrastructure), indicating likely C&C…”
-
Dissecting CrashFix: KongTuke's New Toy“The IP addresses are obfuscated through string concatenation: 170.168.103.208 and 158.247.252[.]178.”
Indicators reported together
named in the same reports- 170.168.103[.]208in 2 reports
- hxxps://ainttby[.]com/6f54.jsin 1 report
- ainttby[.]comin 1 report
- hxxps://ctpsih[.]com/2d5h.jsin 1 report
- ctpsih[.]comin 1 report
- hxxps://foodgefy[.]com/6o0jk.jsin 1 report
- foodgefy[.]comin 1 report
- 162.33.178[.]171in 1 report
- hxxp://45.61.138[.]224/nin 1 report
- 45.61.138[.]224in 1 report
- hxxps://www.dropbox[.]com/scl/fi/np4h0kexqq5r9vlpzwg4d/rp?rlkey=fwg1koexylntccobyxaliju7w&st=3wxzp44k&dl=1in 1 report
- 149.154.164[.]13in 1 report
- hxxps://github[.]com/uBlockOrigin/uBOL-homein 1 report
- hxxps://nexsnield[.]com/install?uuid=550e8400-e29b-41d4-a716-446655440000&version=2025.1116.1842in 1 report
- nexsnield[.]comin 1 report
- hxxps://nexsnield[.]com/update?uuid=550e8400-e29b-41d4-a716-446655440000&version=2025.1116.1842&previous=2025.1115.1000in 1 report
- hxxp://199.217.98[.]108/bin 1 report
- 199.217.98[.]108in 1 report
- hxxp://fyvw2oiv[.]top/1.php?s=63e95be1-92e0-45c1-a928-65d63b17cd1cin 1 report
- fyvw2oiv[.]topin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.