8.218.65[.]184IP address
Reported by 3 independent sources · first reported by Google Threat Intelligence · last reported
Last reported 5 days ago
What the reports say
3 reports, newest first · the exact sentence from each-
AOMEI Backupper update servers hijacked to push malware: Check your PC“…ou’re seeing outgoing traffic to promotion.storage-data.com, aomei.storage-data.com, storage-data.com, 8.210.84.56, 47.239.60.117, or 8.218.65[.]184, whether blocked or allowed.”
-
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor“IP: 8.210.84.56, 8.218.65[.]184, 47.239.60.117”
-
Investigating Ephemeral Supply Chain Tampering“…Python bytecode, which RuntimeComponent.dll executes within an embedded PocketPy interpreter, establishing initial C2 connectivity to 8.218.65[.]184:443.”
Indicators reported together
named in the same reports- 8.210.84[.]56in 3 reports
- promotion.storage-data[.]comin 3 reports
- storage-data[.]comin 3 reports
- aomei.storage-data[.]comin 3 reports
- 47.239.60[.]117in 3 reports
- checkip.amazonaws[.]comin 1 report
- hxxps://www2.aomeisoftware[.]com/download/abpopup/down_html.iniin 1 report
- www2.aomeisoftware[.]comin 1 report
- hxxps://account.aomeitech[.]com/Notifycfg.iniin 1 report
- account.aomeitech[.]comin 1 report
- hxxps://www2.aomeisoftware[.]com/download/abpopup/upgrade-now.zipin 1 report
- hxxps://promotion.storage-data[.]com/download/abpopup/upgrade-now.zipin 1 report
- ee89c99f3753231771170f5d9cbbae1ein 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.