193.32.204[.]199IP address
Reported by 2 independent sources · first reported by Socket · last reported
Last reported 5 days ago
What the reports say
3 reports, newest first · the exact sentence from each-
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories“According to the threat intelligence platform, the threat actor registered the domain "my-github.com" and pointed it at "193.32.204[.]199," the same IP address that's used as an exfiltration endpoint for data harvested from running the malicious workflow.”
-
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories“…itHub Actions Security ("github_actions_security.yml"), which are designed to exfiltrate sensitive data to a hard-coded IP address ("193.32.204[.]199") over plain HTTP.”
-
New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials“It collects credentials and POSTs them to hxxp://193.32.204[.]199.”
Indicators reported together
named in the same reports- hxxp://193.32.204[.]199in 1 report
- hxxp://193.32.204[.]199/?c=monamiin 1 report
- my-gitlab[.]comin 1 report
- my-github[.]comin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.