domain
caliber-spinner-finishing.ngrok-free.dev
discovered 2026-07-07
ngrok tunnel hostname used as C2 / exfiltration endpoint. Recovered at runtime via three-step decode (base64 XOR + per-char subtract-17 + string reverse). The backing IP (not published in source) reportedly carried prior reputation as C2 for other stealers including NjRAT (per Socket).
