ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain license.claude-pro.com.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1808231
IOC: license.claude-pro.com
IOC Type :domain
Threat Type :botnet_cc
Malware: PlugX
Malware alias:Destroy RAT, Kaba, Korplug, Sogu, TIGERPLUG, RedDelta
Confidence Level : Confidence level is moderate (49%)
Is compromised? : False
ASN:AS45102 ALIBABA-CN-NET
Country:- CN
First seen:2026-05-08 07:59:59 UTC
Last seen:2026-05-11 17:10:40 UTC
UUID:0e888e02-4a32-11f1-8759-42010aa4000a
Reporter johannes
Reward 5 credits from ThreatFox
Reference: https://www.sophos.com/en-us/blog/donuts-and-beagles-fake-claude-site-spreads-backdoor

Avatar
johannes
This campaign’s infrastructure appears to be relatively static and limited Monitor for connections to and, from the Sophos report "Donuts and Beagles: Fake Claude site spreads backdoor". See all IOC from that report at https://rosti.dev/reports/nspCUUPZ