8.210.84[.]56IP address
Reported by 4 independent sources · first reported by Google Threat Intelligence · last reported
Last reported 5 days agoFeeds last saw it 20 days ago
What the reports say
3 reports, newest first · the exact sentence from each-
AOMEI Backupper update servers hijacked to push malware: Check your PC“If you’re seeing outgoing traffic to promotion.storage-data.com, aomei.storage-data.com, storage-data.com, 8.210.84[.]56, 47.239.60.117, or 8.218.65.184, whether blocked or allowed.”
-
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor“IP: 8.210.84[.]56, 8.218.65.184, 47.239.60.117”
-
Investigating Ephemeral Supply Chain Tampering“Address="file://8.210.84[.]56/DavWWWRoot/campaign/24hour-flash-sale.html"”
Seen in threat feeds
1 feed| Feed | First seen | Last seen | Sightings | What the feed says |
|---|---|---|---|---|
| abuse.ch ThreatFox | 3 | botnet_cc · AdaptixC2 · adaptix |
Indicators reported together
named in the same reports- promotion.storage-data[.]comin 3 reports
- storage-data[.]comin 3 reports
- aomei.storage-data[.]comin 3 reports
- 8.218.65[.]184in 3 reports
- 47.239.60[.]117in 3 reports
- checkip.amazonaws[.]comin 1 report
- hxxps://www2.aomeisoftware[.]com/download/abpopup/down_html.iniin 1 report
- www2.aomeisoftware[.]comin 1 report
- hxxps://account.aomeitech[.]com/Notifycfg.iniin 1 report
- account.aomeitech[.]comin 1 report
- hxxps://www2.aomeisoftware[.]com/download/abpopup/upgrade-now.zipin 1 report
- hxxps://promotion.storage-data[.]com/download/abpopup/upgrade-now.zipin 1 report
- ee89c99f3753231771170f5d9cbbae1ein 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.