45.13.237[.]190IP address
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity“…hreat actor deployed a rogue ScreenConnect remote access client, configured to communicate with a command-and-control (C2) server at 45.13.237[.]190.”
Indicators reported together
named in the same reports- hxxps://www.connectwise[.]com/company/trust/advisoriesin 1 report
- www.connectwise[.]comin 1 report
- tele-sync.opik[.]netin 1 report
- 131.123.40[.]98in 1 report
- 15.204.185[.]204in 1 report
- 146.59.55[.]107in 1 report
- 45.32.192[.]150in 1 report
- borertors92.anondns[.]netin 1 report
- hxxp://url[.]com/combo.encin 1 report
- url[.]comin 1 report
- homehub.opik[.]netin 1 report
- 08bc4e82883eb42f…2a64f6cc9020in 1 report
- de3b6836a88ae4b1…fcac4089a457in 1 report
- 19a3534da9f60c72…ef08117f3260in 1 report
- 110fffc85370bb7c…becaa3a41d66in 1 report
- de89d560fc8302c7…7eedcbd2aedein 1 report
- ffd6d23f579571cc…f53c3688a0dein 1 report
Copy these 17 indicators · defanged
Also named with it: CVE-2026-84869
Thanks — we review every report.