95.163.153[.]80IP address
Reported by 1 independent source · first reported by SANS Internet Storm Center · last reported
Last reported 29 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)“A string of base64 text shown in the above image translates to a URL for the C2 server: hxxp://95.163.153[.]80:8133/api/t”
-
Macfinger ClickFix campaign, (Tue, Sep 22nd)“2026-09-21 23:12:59 UTC - hxxp://95.163.153[.]80:8133 - POST /api/t”
Indicators reported together
named in the same reports- notes[.]appin 1 report
- terminal[.]appin 1 report
- hollow-badger-moasfraum[.]lifein 1 report
- hxxp://45.131.215[.]56/8031e818c7a46?force=1in 1 report
- 45.131.215[.]56in 1 report
- hxxp://45.131.215[.]56/a7a11f95?force=1in 1 report
- hxxp://45.131.215[.]56/4e04813226b1b93?force=1in 1 report
- hxxp://95.163.153[.]80:8133/api/tin 1 report
- c6da028e0a8a25a3…1a49a5668912in 1 report
- 457ed02b0a63ccf8…18cc538055b7in 1 report
- 5a2242b862ef52fe…2e6d4b35c6fbin 1 report
- 3e26e006210ed398…8d45c56e1a89in 1 report
- 4a59528492326918…28f2839fb5b6in 1 report
- hxxp://95.163.153[.]80:8133/api/credentialsin 1 report
- hxxp://95.163.153[.]80:8133/api/shell/agentin 1 report
- hxxps://velvet-otter-glagceis[.]life/t.js?site=4f0529f47320472732961318d7d0dfd1in 1 report
- velvet-otter-glagceis[.]lifein 1 report
- hxxps://velvet-otter-glagceis[.]life/t.4b1009ff6c3f.jsin 1 report
- hxxps://velvet-otter-glagceis[.]life/ext-b.4f9db6afd06a.jsin 1 report
- hxxps://velvet-otter-glagceis[.]life/collectin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.