hxxp://65.98.5[.]158:31337/Ins.TxtURL
Reported by 1 independent source · first reported by AhnLab ASEC · last reported
Last reported 27 days ago
What the reports say
1 report, newest first · the exact sentence from each-
Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability“hxxp://65.98.5[.]158:31337/Ins.Txt (Receiving the list of targets to scan)”
Indicators reported together
named in the same reports- 65.98.5[.]158in 1 report
- hxxp://api.telegram[.]org/bot8930981923:AAGatbhK2_eiLMNtnWHkq33E6u7clhMPj5Q/sendMessagein 1 report
- hxxp://api.telegram[.]org/bot8930981923:AAGatbhK2_eiLMNtnWHkq33E6u7clhMPj5Q/sendDocumentin 1 report
- 0a4be0b6c650ffdcd1c22db56f1c4aecin 1 report
- 10f705728d228ad949b7894c1a85a2b1in 1 report
- 177e34d9174766a1d187a0c82de4c02fin 1 report
- 18fb4e070653fc9791e0e408d8cb1c8ein 1 report
- 1dbfda02d74b6a7586c4430175204c28in 1 report
- hxxp://2.59.133[.]147:31338/ins.txtin 1 report
- 2.59.133[.]147in 1 report
- hxxp://2.59.133[.]147:31338/sm.jsonin 1 report
- hxxp://206.82.6[.]22/in 1 report
- 206.82.6[.]22in 1 report
- hxxp://45.138.16[.]187:31337/bb.jsonin 1 report
- 45.138.16[.]187in 1 report
- hxxp://45.138.16[.]187:31337/cofuz.jsonin 1 report
Copy these 16 indicators · defanged
Also named with it: CVE-2019-18935
Thanks — we review every report.