Indicators of Compromise
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.
| value | context | campaigns | Copy |
|---|---|---|---|
| domain169.254.169.254 | Network indicator from blog post | 1 | |
| sha256ce7e4199506959fd7a71b64209b2c07b9c82e53a946aa7d78298dc9249230d01 | SHA-256 hash from blog post | 1 | |
| sha179ac49eedf774dd4b0cfa308722bc463cfe5885c | SHA-1/commit-like hash from blog post | 1 | |
| domain82.221.101.203 | Network indicator from blog post | 1 | |
| ipv482.221.101.203 | IP address indicator from blog post | 1 | |
| sha256263df2348f54f1f4980542a41f69d77b085fb28091a95979ba7f0e9f3d0da861 | SHA-256 hash from blog post | 1 | |
| emailnoondeved94ed@wshu.net | Email indicator from blog post | 2 | |
| domain172.86.73.132 | Network indicator from blog post | 1 | |
| ipv4172.86.73.132 | IP address indicator from blog post | 1 | |
| sha25686d17961e9662c53e1fb61701388b7c741bf79c093061df968a3e53c829dcb16 | SHA-256 hash from blog post | 1 | |
| emaildaltonchristiano060@gmail.com | Email indicator from blog post | 1 | |
| domainpaidgirl.site | Operator-controlled origin allow-listed in common-tg-service auth guard | 0 | |
| domaincms.paidgirl.site | ams-ssk deployment serving folders/:folder/files/download-all consumed by common-tg-service | 1 | |
| domainhelper-thge.onrender.com | Attribution-laundering HTTP relay; used by common-tg-service on 403/495 responses | 1 | |
| domainpromoteclients2.glitch.me | Operator host leaked in ams-ssk Swagger DTO; sequential staging (promoteClients2) | 0 | |
| domainzomcall.netlify.app | Allowed origin in common-tg-service auth guard | 0 | |
| domainreport-upi.netlify.app | Allowed origin; names the UPI/India targeting | 0 | |
| emailstoreslaksmi@gmail.com | Hardcoded 2FA recovery email implanted on every hijacked Telegram account | 1 | |
| emaildodieajt@gmail.com | Operator npoint.io account credentials committed in npoint.service.js | 0 | |
| emailshettysaikumar3@gmail.com | npm publisher email for shetty123 (publisher of both packages) | 0 | |
| ipv431.97.59.2 | Operator IP allow-listed in common-tg-service auth guard | 0 | |
| ipv4148.230.84.50 | Operator IP allow-listed in common-tg-service auth guard | 0 | |
| ipv413.228.225.19 | Operator IP allow-listed in common-tg-service auth guard | 0 | |
| ipv418.142.128.26 | Operator IP allow-listed in common-tg-service auth guard | 0 | |
| ipv454.254.162.138 | Operator IP allow-listed in common-tg-service auth guard | 0 | |
| sha15061bc9611e31a48a8085cfab4cb875a6cc633ec | common-tg-service-1.3.207.tgz npm tarball | 0 | |
| sha180da04770a779330803bdd00d00a354adc12859a | ams-ssk-1.0.33.tgz npm tarball | 0 | |
| domain152.67.0.53 | Network indicator from blog post | 1 | |
| ipv4152.67.0.53 | IP address indicator from blog post | 1 | |
| sha256e2fda5aa8397799669f29258f69e803cf05d322c1d93269eef6754ca024c3865 | SHA-256 hash from blog post | 1 | |
| sha2563071422c3294e7b61cb490c57c48c8dea569bacf12e57a078293b6547d7586d3 | SHA-256 hash from blog post | 1 | |
| sha25656070a9d8de0c0ffb1ec5c309953cf4679432df5a78df9aeb020fbb73d2be9fb | SHA-256 hash from blog post | 1 | |
| sha2565f5852b5f604369945118937b058e49064612ac69826e0adadca39a357dfb5b1 | SHA-256 hash from blog post | 1 | |
| sha256d2815d425ae08cc627f1db69009442165f8bbc64b7e9157e2ff9d7aab02094d4 | SHA-256 hash from blog post | 1 | |
| sha2568046a11187c135da6959862ff3846e99ad15462d2ec8a2f77a30ad53ebd5dcf2 | SHA-256 hash from blog post | 1 | |
| sha2562d4e21d2e78d0868ce7894487e67c67f929d8d81d78c5b07a3ad225b13eae890 | SHA-256 hash from blog post | 1 | |
| sha10a3dd44d361c34cd9036eeb3f49601160a636648 | SHA-1/commit-like hash from blog post | 1 | |
| domainfranki.requestcatcher.com | Network indicator from blog post | 1 | |
| ipv4169.254.169.254 | AWS IMDS endpoint queried for cloud credentials | 3 | |
| emailnpmtpoc@gmail.com | Email indicator from blog post | 1 | |
| ipv418.208.244.120 | IP address indicator from blog post | 1 | |
| md50123456789abcdef0123456789abcdef | MD5 hash from blog post | 1 | |
| domainaudit.checkmarx.cx | Network indicator from blog post | 1 | |
| ipv494.154.172.43 | IP address indicator from blog post | 1 | |
| sha25618f784b3bc9a0bcdcb1a8d7f51bc5f54323fc40cbd874119354ab609bef6e4cb | SHA-256 hash from blog post | 1 | |
| sha2568605e365edf11160aad517c7d79a3b26b62290e5072ef97b102a01ddbb343f14 | SHA-256 hash from blog post | 1 | |
| sha1de0fac2e4500dabe0009e67214ff5f5447ce83dd | SHA-1/commit-like hash from blog post | 2 | |
| sha1bbbca2ddaa5d8feaa63e36b76fdaad77386f024f | SHA-1/commit-like hash from blog post | 2 | |
| ipv40.0.0.0 | IP address indicator from blog post | 1 | |
| emailfucktestpad@opemails.com | Email indicator from blog post | 1 |