ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://trofedi.top/reset/tenant-pipeline.php.

Database Entry

This IOC expired

This IOC is an old IOC and hence has expired on 2026-09-15 08:57:45 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.

IOC ID:	1759224
IOC:	https://trofedi.top/reset/tenant-pipeline.php
IOC Type :	url
Threat Type :	payload_delivery
Malware:	SmartApeSG
Malware alias:	HANEYMANEY, ZPHP
Confidence Level :	Confidence level is high (100%)
Is compromised? :	True
ASN:	AS213230 HETZNER-CLOUD2-AS
Country:	DE
First seen:	2026-03-06 07:12:18 UTC
Last seen:	2026-03-05 21:08:56 UTC
UUID:	e9683848-18ce-11f1-9af6-42010aa4000a
Reporter	monitorsg
Reward	5 credits from ThreatFox
Tags:	SmartApeSG
Reference:	https://infosec.exchange/@monitorsg/116178368753014125

monitorsg

hXXps://www.ski-snowboardvancouver[.]ca/d.js (injected) --> hXXps://trofedi[.]top/reset/admin-hook.js --> hXXps://trofedi[.]top/reset/tenant-pipeline.php --> hXXps://trofedi[.]top/reset/private-compiler.js (clickfix) --> hXXps://amfredio[.]com/server (HTA) --> hXXps://amfredio[.]com/success (ZIP)