ipv4

23.254.164.92

discovered 2026-06-17

Stage-2 download host (dropper). HTTPS GET to https://23.254.164.92:8000/update/49890878. Hostwinds, PTR hwsrv-1327786.hostwindsdns.com. User-Agent gated: serves payload only to Node default UA.

Campaigns

Linked packages

Read the full analysis →