45.131.215[.]56IP address
Reported by 1 independent source · first reported by SANS Internet Storm Center · last reported
Last reported 29 days ago
What the reports say
1 report, newest first · the exact sentence from each-
A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)“The ClickFix text retrieved a loader from hxxp://45.131.215[.]56/8031e818c7a46?force=1.”
Indicators reported together
named in the same reports- notes[.]appin 1 report
- terminal[.]appin 1 report
- hollow-badger-moasfraum[.]lifein 1 report
- hxxp://45.131.215[.]56/8031e818c7a46?force=1in 1 report
- hxxp://45.131.215[.]56/a7a11f95?force=1in 1 report
- hxxp://45.131.215[.]56/4e04813226b1b93?force=1in 1 report
- hxxp://95.163.153[.]80:8133/api/tin 1 report
- 95.163.153[.]80in 1 report
- c6da028e0a8a25a3…1a49a5668912in 1 report
- 457ed02b0a63ccf8…18cc538055b7in 1 report
- 5a2242b862ef52fe…2e6d4b35c6fbin 1 report
- 3e26e006210ed398…8d45c56e1a89in 1 report
- 4a59528492326918…28f2839fb5b6in 1 report
- hxxp://95.163.153[.]80:8133/api/credentialsin 1 report
- hxxp://95.163.153[.]80:8133/api/shell/agentin 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.