222.223.152[.]97IP address

Reported by 1 independent source · first reported 5 Oct 2026 by Fortinet Threat Research · last reported 5 Oct 2026

Last reported 19 days ago

What the reports say

1 report, newest first · the exact sentence from each

“The next download source was 222.223.152[.]97, which the threat actor began exploiting by targeting multiple vulnerabilities.”

Fortinet Threat ResearchVendor5 Oct 2026
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

Indicators reported together

named in the same reports

c1d8e2829ea63b9d…78e908e0e6e8in 1 report
e6e113783356446a…76f095a95c4cin 1 report
124.163.212[.]119in 1 report
118.145.196[.]225in 1 report

Copy these 4 indicators · defanged

4 indicators, defanged, one per line

c1d8e2829ea63b9dc1cf2c3421a5093406adad4d6622e238376e78e908e0e6e8
e6e113783356446aef66e5296db45b244f318292af7cebc2a9bd76f095a95c4c
124.163.212[.]119
118.145.196[.]225

Also named with it: CVE-2016-20016, CVE-2025-67038, CVE-2024-21887, CVE-2023-46805, CVE-2022-37055, CVE-2023-1389, CVE-2024-10914, CVE-2014-8361, CVE-2021-35394, CVE-2023-26801, CVE-2023-41011, CVE-2024-3721, CVE-2025-34037, CVE-2022-36553, CVE-2025-34035, CVE-2024-23625

Thanks — we review every report.

Report a wrong value