47.18.167[.]159IP address

Reported by 1 independent source · first reported 14 Oct 2026 by Palo Alto Unit 42 · last reported 14 Oct 2026

Last reported 10 days ago

What the reports say

1 report, newest first · the exact sentence from each

“hxxp://47.18.167[.]159:8085/pM.js”

Palo Alto Unit 42Vendor14 Oct 2026
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

Indicators reported together

named in the same reports

45.32.41[.]202in 1 report
198.199.122[.]22in 1 report
system[.]autoin 1 report
hxxp://23.240.77[.]233:8085/in 1 report
23.240.77[.]233in 1 report
b9fb0b27ddd59b58…533bb9cd1e70in 1 report
829b1cd270b30565…8ae4a0431f11in 1 report
bd064244dad748cf…febd4c1fe02ain 1 report
9c4c4436ff5cdf0d…af7a7110437ein 1 report
fc1b10c58057ef9f…a6e0312b36eein 1 report
f84eea718526706a…8249c5e379abin 1 report
b7ae166fd49a7ecf…fb7d14ce15a8in 1 report
8d969eef6ecad3c2…0c923adc6c92in 1 report
hxxp://23.240.77[.]233:8085/pM.jsin 1 report

Copy these 14 indicators · defanged

14 indicators, defanged, one per line

45.32.41[.]202
198.199.122[.]22
system[.]auto
hxxp://23.240.77[.]233:8085/
23.240.77[.]233
b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70
829b1cd270b30565739a478441833f49f10a49bd06f0d18cc96c8ae4a0431f11
bd064244dad748cf2a44074bee56f5bfab4a2b18ee944b75d1b3febd4c1fe02a
9c4c4436ff5cdf0d6d68f5108031cbf3708a095cde4ef8c09316af7a7110437e
fc1b10c58057ef9f1f9a1e2a3d4a1c89f43b0ead451398c70ed7a6e0312b36ee
f84eea718526706afdf2d1a2774fab76ecb11c18fb61995a37be8249c5e379ab
b7ae166fd49a7ecfe6322a80b8aa56d6aa0825d8f5d106dab2e4fb7d14ce15a8
8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92
hxxp://23.240.77[.]233:8085/pM.js

Also named with it: CVE-2024-47575, CVE-2025-61624, CVE-2024-26009, CVE-2024-26008, CVE-2025-59718, CVE-2025-59719

Thanks — we review every report.

Report a wrong value