80.78.27[.]252IP address
Reported by 2 independent sources · first reported by Security Affairs · last reported
Last reported 16 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories“…network indicators, said "the command hostname reported on 31 August, c2.installscenter.com, was already serving TLS on a second VPS (80.78.27[.]252) on port 2083 from 4 April 2026, almost five months before the disclosure.”
-
Hunt.io Finds New Infrastructure Of BraZetsu Access Broker Months Before Disclosure“Our records show c2.installscenter.com resolving to 80.78.27[.]252 between 22 and 26 March, and to Cloudflare (104.21.78.246, 172.67.138.224) from 26 March on.” states the report.”
Indicators reported together
named in the same reports- hunt[.]ioin 2 reports
- c2.installscenter[.]comin 2 reports
- painel.installscenter[.]comin 2 reports
- installscenter[.]comin 1 report
- painel.seu-dominio[.]comin 1 report
- 104.21.78[.]246in 1 report
- 172.67.138[.]224in 1 report
- 45.138.12[.]177in 1 report
- 151.243.232[.]123in 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.