38.246.250[.]201IP address

Reported by 1 independent source · first reported 15 Oct 2025 by Huntress · last reported 15 Oct 2025

Last reported 12 months ago

What the reports say

1 report, newest first · the exact sentence from each

“…king at subdomains of the threat actor C2 domain bj2.xyz found an interesting subdomain lhr, which pointed to a different IP address 38.246.250[.]201 hosted on what looks to be a dedicated IP provided by Netlab Global.”

HuntressVendor15 Oct 2025
The Crown Prince, Nezha

Indicators reported together

named in the same reports

54.46.50[.]255in 1 report
6f336f372c5a642b57413363265e7d7ein 1 report
45.207.220[.]12in 1 report
c.mid[.]alin 1 report
host.404111[.]xyzin 1 report
gd.bj2[.]xyzin 1 report
bj2[.]xyzin 1 report
f3570bb6e0f9c695…3ffd9fd7ad16in 1 report
hxxps://rism.pages[.]dev/microsoft.exein 1 report
rism.pages[.]devin 1 report
9f33095a24471bed…14efcd9e7de6in 1 report
7b2599ed54b72dae…5e4606dbc958in 1 report
82611e60a2c5de23…a84031d87999in 1 report
35e0b22139fb27d2…5ff8fce210f3in 1 report
172.245.52[.]169in 1 report

Copy these 15 indicators · defanged

15 indicators, defanged, one per line

54.46.50[.]255
6f336f372c5a642b57413363265e7d7e
45.207.220[.]12
c.mid[.]al
host.404111[.]xyz
gd.bj2[.]xyz
bj2[.]xyz
f3570bb6e0f9c695d48f89f043380b43831dd0f6fe79b16eda2a3ffd9fd7ad16
hxxps://rism.pages[.]dev/microsoft.exe
rism.pages[.]dev
9f33095a24471bed55ce11803e4ebbed5118bfb5d3861baf1c8214efcd9e7de6
7b2599ed54b72daec0acfd32744c7a9a77b19e6cf4e1651837175e4606dbc958
82611e60a2c5de23a1b976bb3b9a32c4427cb60a002e4c27cadfa84031d87999
35e0b22139fb27d2c9721aedf5770d893423bf029e1f56be92485ff8fce210f3
172.245.52[.]169

Thanks — we review every report.

Report a wrong value