2.58.56[.]16IP address
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 17 months ago
What the reports say
3 reports, newest first · the exact sentence from each-
Do Tigers Really Change Their Stripes?“…dicators of Compromise (IOC) sections, an astute reader will notice some commonalities between the two; specifically, IOCs such as the 2.58.56[.]16 IP address, installation of the Mesh Agent RMM, and the d3d11.dll file.”
-
CVE-2025-30406: Gladinet CentreStack & Triofox Exploited“2.58.56[.]16”
-
CrushFTP CVE-2025-31161 Auth Bypass and Post-Exploitation“Accepting connection from: 2.58.56[.]16:50860”
Indicators reported together
named in the same reports- rtb.mftadsrvr[.]comin 2 reports
- 196.251.85[.]31in 1 report
- hxxps://gladinetsupport.s3.us-east-1.amazonaws[.]com/gladinet/securityadvisory-cve-2005.pdfin 1 report
- gladinetsupport.s3.us-east-1.amazonaws[.]comin 1 report
- hxxps://gladinetsupport.s3.us-east-1.amazonaws[.]com/gladinet/securityadvisory-cve-2025-triofox.pdfin 1 report
- hxxp://redacted.oastify[.]com/REDACTEDin 1 report
- redacted.oastify[.]comin 1 report
- hxxp://redacted.oast[.]funin 1 report
- redacted.oast[.]funin 1 report
- 104.21.16[.]1in 1 report
- 104.21.48[.]1in 1 report
- 48b006cb17e75ecd…abca1c5fabbfin 1 report
- 30981d4082b58704…26aef21e75c2in 1 report
- 165.227.7[.]206in 1 report
- 45.84.107[.]76in 1 report
- 172.235.144[.]67in 1 report
- 114c196c39c91575880a5012d06565b1in 1 report
Copy these 17 indicators · defanged
Also named with it: CVE-2025-31161, CVE-2025-30406, CVE-2025-2825
Thanks — we review every report.