hxxp://2.59.133[.]147:31338/ins.txtURL
Reported by 1 independent source · first reported by AhnLab ASEC · last reported
Last reported 17 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
Q3 2026 Statistical Report on Malware Targeting Windows Web Servers“hxxp://2.59.133[.]147:31338/ins.txt”
-
Vulnerability Attack Case: Installation of a Web Shell and Execution of a Scanner by Exploiting a Telerik UI Vulnerability“hxxp://2.59.133[.]147:31338/ins.txt”
Indicators reported together
named in the same reports- 0a4be0b6c650ffdcd1c22db56f1c4aecin 2 reports
- 10f705728d228ad949b7894c1a85a2b1in 2 reports
- 177e34d9174766a1d187a0c82de4c02fin 2 reports
- 18fb4e070653fc9791e0e408d8cb1c8ein 2 reports
- 1dbfda02d74b6a7586c4430175204c28in 2 reports
- 2.59.133[.]147in 2 reports
- hxxp://2.59.133[.]147:31338/sm.jsonin 2 reports
- hxxp://206.82.6[.]22/in 2 reports
- 206.82.6[.]22in 2 reports
- hxxp://45.138.16[.]187:31337/bb.jsonin 2 reports
- 45.138.16[.]187in 2 reports
- hxxp://45.138.16[.]187:31337/cofuz.jsonin 2 reports
- hxxp://65.98.5[.]158:31337/Ins.Txtin 1 report
- 65.98.5[.]158in 1 report
- hxxp://api.telegram[.]org/bot8930981923:AAGatbhK2_eiLMNtnWHkq33E6u7clhMPj5Q/sendMessagein 1 report
- hxxp://api.telegram[.]org/bot8930981923:AAGatbhK2_eiLMNtnWHkq33E6u7clhMPj5Q/sendDocumentin 1 report
Copy these 16 indicators · defanged
Also named with it: CVE-2019-18935
Thanks — we review every report.