195.26.248[.]212IP address

Reported by 1 independent source · first reported 18 Jul 2026 by Elastic Security Labs · last reported 18 Jul 2026

Last reported 3 months ago

What the reports say

1 report, newest first · the exact sentence from each

“| 195.26.248[.]212 | ipv4 | | OTTERCOOKIE C2 Server |”

Elastic Security LabsVendor18 Jul 2026C2
New North Korean campaign uses fake coding interviews to steal developer credentials

Indicators reported together

named in the same reports

obfuscator[.]ioin 1 report
ldb.rightwidth[.]devin 1 report
upload.rightwidth[.]devin 1 report
code[.]appin 1 report
controller.rightwidth[.]devin 1 report
file.rightwidth[.]devin 1 report
rightwidth[.]devin 1 report
8e571d58794b9b44…63adcba55b1ein 1 report
3e6360f83a95540a…6b5bcf3b9c3cin 1 report
4e7639045b4a64de…42ed27f09864in 1 report
54bf36910d81ab51…c1fc738dc5a9in 1 report
96357529d17c4690…898f0635ef20in 1 report
9df01d242ef46adf…84090d579886in 1 report
c5aed4c063d4970a…0ad72567ebd9in 1 report
cc97517f80f56797…c99fe9e45730in 1 report
fb94b2caee2c4063…8fa42351f53fin 1 report
188.40.64[.]61in 1 report

Copy these 17 indicators · defanged

17 indicators, defanged, one per line

obfuscator[.]io
ldb.rightwidth[.]dev
upload.rightwidth[.]dev
code[.]app
controller.rightwidth[.]dev
file.rightwidth[.]dev
rightwidth[.]dev
8e571d58794b9b44ae53c2c67bedef72c500e8adbb80aab7a5c263adcba55b1e
3e6360f83a95540aa2176d279ca4694513afb1e5116a7ffe591c6b5bcf3b9c3c
4e7639045b4a64de60bfb6312951a5c3dffbd3fb04b84837663242ed27f09864
54bf36910d81ab516037cb3d69d7c85190f90aa0da9e58617799c1fc738dc5a9
96357529d17c4690826d5d4c74deac51743a5388733b3f04004d898f0635ef20
9df01d242ef46adfedf8c35cb7cc67b1d27d7dc4a1ce74ab32e984090d579886
c5aed4c063d4970a03250778da8041da9e0c83d8f22d2f1994da0ad72567ebd9
cc97517f80f567977300450de11e9a0be53f52657525a20b1091c99fe9e45730
fb94b2caee2c40635448a98ba0118421e19a400e74ccff73315f8fa42351f53f
188.40.64[.]61

Thanks — we review every report.

Report a wrong value