hxxp://95.163.153[.]80:8133/api/tURL

Reported by 1 independent source · first reported 25 Sep 2026 by SANS Internet Storm Center · last reported 25 Sep 2026

Last reported 29 days ago

What the reports say

1 report, newest first · the exact sentence from each

“A string of base64 text shown in the above image translates to a URL for the C2 server: hxxp://95.163.153[.]80:8133/api/t”

SANS Internet Storm CenterVendor25 Sep 2026C2
A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)

Indicators reported together

named in the same reports

notes[.]appin 1 report
terminal[.]appin 1 report
hollow-badger-moasfraum[.]lifein 1 report
hxxp://45.131.215[.]56/8031e818c7a46?force=1in 1 report
45.131.215[.]56in 1 report
hxxp://45.131.215[.]56/a7a11f95?force=1in 1 report
hxxp://45.131.215[.]56/4e04813226b1b93?force=1in 1 report
95.163.153[.]80in 1 report
c6da028e0a8a25a3…1a49a5668912in 1 report
457ed02b0a63ccf8…18cc538055b7in 1 report
5a2242b862ef52fe…2e6d4b35c6fbin 1 report
3e26e006210ed398…8d45c56e1a89in 1 report
4a59528492326918…28f2839fb5b6in 1 report
hxxp://95.163.153[.]80:8133/api/credentialsin 1 report
hxxp://95.163.153[.]80:8133/api/shell/agentin 1 report

Copy these 15 indicators · defanged

15 indicators, defanged, one per line

notes[.]app
terminal[.]app
hollow-badger-moasfraum[.]life
hxxp://45.131.215[.]56/8031e818c7a46?force=1
45.131.215[.]56
hxxp://45.131.215[.]56/a7a11f95?force=1
hxxp://45.131.215[.]56/4e04813226b1b93?force=1
95.163.153[.]80
c6da028e0a8a25a35efa28ba508a556d1b53d1e61113c0aaebf31a49a5668912
457ed02b0a63ccf872e8459c91e2d1d6844a75414358849333f518cc538055b7
5a2242b862ef52fe7a08af596198412a7676c948bcd64a25ce5d2e6d4b35c6fb
3e26e006210ed398f98c090e9f1c982e76b3b73f1ce3e04ee1bf8d45c56e1a89
4a5952849232691849ed900609d7ff271ce296fe3cee4a81b58c28f2839fb5b6
hxxp://95.163.153[.]80:8133/api/credentials
hxxp://95.163.153[.]80:8133/api/shell/agent

Thanks — we review every report.

Report a wrong value