46.21.250[.]135IP address
Reported by 3 independent sources · first reported by SOCRadar · last reported
Last reported 12 days ago
What the reports say
3 reports, newest first · the exact sentence from each-
CyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records“The exposed server was found at “46.21.250[.]135,” hosting a live Linux workstation’s complete contents.”
-
CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records“SOCRadar said it discovered the operation after it identified an exposed open directory hosted at "46.21.250[.]135" that leaked the threat actor's live working directory associated with a Linux workstation, including AI session logs, scripts with plaintext tokens, exploitation tool…”
-
CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure“The investigation began with an HTTP server at 46.21.250[.]135 (AS204601, Zomro NL) exposed as an open directory with no access control.”
Indicators reported together
named in the same reports- exploit[.]inin 1 report
- r00t-shell[.]comin 1 report
- 45.88.106[.]2in 1 report
- 212.193.31[.]189in 1 report
- 91.208.184[.]148in 1 report
- 45.88.106[.]78in 1 report
- 49.234.12[.]182in 1 report
- 42.193.100[.]94in 1 report
- 92a789444708fa1c…5a18197d0090in 1 report
- a5ae0aab352871bc…592cd34eb86cin 1 report
- 71e21094c1ac1cf0…682681fc1192in 1 report
Copy these 11 indicators · defanged
Also named with it: CVE-2026-60137, CVE-2026-63030, CVE-2026-4815, CVE-2021-4034, CVE-2026-0257, CVE-2022-28368, CVE-2023-7028, CVE-2024-1086, CVE-2020-1938
Thanks — we review every report.