APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API

Indicators of Compromise

Every IOC SafeDep has linked to a malicious package or campaign — domains, IPs, emails, hashes, and crypto wallets.

Indicators of Compromise, page 18 of 22
value	context	campaigns
domain204.10.194.247	Network indicator from blog post	1
ipv4204.10.194.247	C2 server (AS206216 Advin Services LLC, Nurnberg DE). WebSocket relay on port 9877, HTTP API on port 8765. Shared across all forge-jsx/forge-jsxy/forge-jsx4 waves.	1
sha2564cb96c3b033c1aaf7b3d0fe54749058f14d4d914947a6d6d430aca108a7daa5a	SHA-256 of forge-jsx (Wave 1)	1
emailjohn@taohunter.ai	npm account email for johntaohunter, publisher of @johntaohunter/forge-jsx	1
emailjohnceballos0716@gmail.com	npm account email for johnceballos0716, publisher of forge-jsx (Wave 1)	1
domainapi-sub.jrodacooker.dev	Earlier C2 domain for js-logger-pack, DNS since removed	1
domainhuggingface.co	Network indicator from blog post	1
ipv4195.201.194.107	WebSocket + HTTP C2 server on port 8010. Hetzner, DE, AS24940. Secondary hostname: copilot-ai.whisdev.org.	1
sha256a49eee6b6db9da14db46587b68bf1d8a80976812f629bf3e100ac6ba83cf8490	SHA-256 hash from blog post	1
sha2566ce3b22b07fd5aef1dd77237334d80718601e4e02a706485572d3dda8993a4e3	SHA-256 hash from blog post	1
sha256571533a643e67c38087f4da8cce0d3dc14670a52403717e4943433d392860a7f	SHA-256 hash from blog post	1
sha256585c5ab1fea06bed4956e34ffd6d6b576122addd34d252b163ae0801098e9eaf	SHA-256 hash from blog post	1
sha2569f0a7174f9537bdbf63fe2329cea9a14198076180390af9f43a0e5b5c7c46912	SHA-256 hash from blog post	1
sha256e35801137cd09fa02aa996145d18ec68d67d71db9810f2608a6285ee1c08b054	SHA-256 hash from blog post	1
sha256df45bbac7695f0edad3edde36904f2722f2af761887744a2f1d65df705d28dc6	SHA-256 hash from blog post	1
sha25643c93c609d48b6cb4f1275c285b5e6960ef74e7f5811b442e3c1038d49128d73	SHA-256 hash from blog post	1
sha256dbbc31c641c2f1b9a867e745c30dda27dff2db7d91f9faddcf08a504ca2a9d11	SHA-256 hash from blog post	0
sha1b0a0c8779961bcce1851d35125a7b48fc6ec7d5c	SHA-1/commit-like hash from blog post	0
emailjpeek868@gmail.com	npm publisher account jpeek868, author of js-logger-pack. Part of jpeek account rotation cluster (jpeek868/886/895). DPRK Famous Chollima.	1
domainxienztiavkygvacpqzgr.supabase.co	Network indicator from blog post	1
domainndfcioahsbgsjmulpjgt.supabase.co	Network indicator from blog post	1
sha2564600db4fc30fb6ffa68deed4a25679e674bb3a3e8dae31f3dfc83bea0d757a8f	SHA-256 hash from blog post	1
sha2562e131f47090516e5a60553aa40d46823e08162390c1d6deb075cf317f00309f7	SHA-256 hash from blog post	1
emailtanvisoul9@gmail.com	Email indicator from blog post	1
domain64.227.183.144	Network indicator from blog post	1
ipv464.227.183.144	IP address indicator from blog post	1
emailvictim59@proton.me	Email indicator from blog post	1
domaincloudflareinsights.vercel.app	Network indicator from blog post	1
domaincloudflarefirewall.vercel.app	Network indicator from blog post	1
sha25655bee3abfa26a78989baae1053a778d3b4a984d5451621a851211a45fe2a82b9	SHA-256 hash from blog post	1
sha25602a00a158ceedaaf7a4bf53002a74d60339d4668d463831fe218905816b72e07	SHA-256 hash from blog post	1
sha2569d2037fc0ad9ada672d30e17a9496cbde392c5093a9fde0b8f16d28e2e0c50c7	SHA-256 hash from blog post	1
sha2567bff4518f4d49ddf3d04d8167a6f5f17aed9b3703290f65cf71c61ea61f0a7bc	SHA-256 hash from blog post	1
sha256aa36d4bee44ee1d35af0e211e8cca957044c782b177787b1181d18d6d6323037	SHA-256 hash from blog post	1
sha256f4914c528cf92a7e97ac3b24138afb86b4cd9db6960d92ffbbff36a1fb90ead9	SHA-256 hash from blog post	1
sha256fc095d3e6a613e27d267d80b448101ef78b02ec07dd3993c734202839015fb54	SHA-256 hash from blog post	1
sha25686f60a2196c3d1355efdcfee41f1549c30c6081bf6c106d11e44a64691f8ebd3	SHA-256 hash from blog post	1
emailvanes.s.p.orit.a@googlemail.com	Email indicator from blog post	1
emailsupport@polymarket.com	Email indicator from blog post	1
emailm8ch88l@gmail.com	Email indicator from blog post	0
domaintelemetry.api-monitor.com	Network indicator from blog post	1
ipv4143.198.237.25	IP address indicator from blog post	1
ipv423.236.116.77	IP address indicator from blog post	1
ipv4209.34.235.18	IP address indicator from blog post	1
sha2564dbecce9ab3cf1739a9b90f9a9f304a3a44f69332320ae0753c129cf078e6f34	SHA-256 hash from blog post	1
sha256513eed96cabdea495a7141666eb77216dee6f0754ef643917346a47a2ff61476	SHA-256 hash from blog post	1
sha256834b6e5db5710b9308d0598978a0148a9dc832361f1fa0b7ad4343dcceba2812	SHA-256 hash from blog post	1
domain89.36.224.5	Network indicator from blog post	1
domaindatahub.ink	Network indicator from blog post	1
domaincloud-sync.online	Network indicator from blog post	1