blob: 36aae8c007a3e4767e9b2db460bb7aaff3049663 (
plain)
1
2
3
4
5
6
7
8
9
10
11
|
# C2 and Exploitation Paths Observed
# PFCLOUD (AS51396)
http://169.254.169.254/latest/user-data -- cloud metadata probe, 176.65.148.142, port 3001
/src/universalTouchGamepad.js -- zgrab web scanner probe, 45.135.194.31, ports 3000/3001
http://proxy.flarevpn.digital:8080/judge -- proxy-quality judge check, 45.135.194.113, port 8019
# PLI-AS (AS51852)
/.env -- environment file exfiltration, 179.43.150.26, ports 8001/8443
/.git -- git repository discovery, 179.43.150.26, ports 8001/8443
/z5044, /s/5124, /.e2382 -- randomized directory-bruteforce paths, 179.43.150.26
|
