ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://bulbous-bouffant.metalseed.net/epoch/enroll.

Database Entry


IOC ID:1781067
IOC: https://bulbous-bouffant.metalseed.net/epoch/enroll
IOC Type :url
Threat Type :botnet_cc
Malware: Unknown malware
Confidence Level : Confidence level is high (90%)
Is compromised? : False
ASN:AS32244 LIQUIDWEB
Country:- US
First seen:2026-04-06 07:56:23 UTC
Last seen:never
UUID:4df5155c-303b-11f1-9af6-42010aa4000a
Reporter tipo_deincognito
Reward 5 credits from ThreatFox
Tags:fake-miner infostealer pypi supply-chain

Avatar
tipo_deincognito
PyPI clawrtc/clawskill fake PoA miner. Consent disclosure claims no personal data; miner.py exfiltrates all MAC addresses and hostname. Epoch enrollment endpoint: victim device enrolled every 10 minutes. 21 live victims confirmed.