blob: 65c2a54b8a3d4f58929aefbdd8d9bceff7149854 (
plain)
1
2
3
4
5
6
7
8
9
10
11
|
/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows -- SPARK C2 beacon POST, 185.100.87.136 FLOKINET, 1 hit this week
/eventmanager -- SPARK C2 channel, 185.100.87.136
/ajax -- SPARK C2 polling, 185.100.87.136
/api/v1/update -- SPARK C2 update check, 185.100.87.136
/FD873AC4-CF86-4FED-84EC-4BD59C6F17A7 -- SPARK agent UUID path, 185.100.87.136
/images/transparentpix.gif -- beaconing pixel, 185.100.87.136
/.env -- env file exfil, 77.83.39.6 KPRONET/PFCLOUD, 25+ hits high-confidence malicious
/.git/HEAD -- git metadata exfil, 77.83.39.94
/wsman -- WinRM brute POST, 154.93.53.239 KAOPU + 179.43.185.147 PLI
/api/trpc/setup.setup -- tRPC setup probe, 179.43.150.26 PLI
/version -- Docker API probe, 179.43.175.56 PLI
|
