ThreatFox IOC Database

You are viewing the ThreatFox database entry for url https://88.99.120.224.

Database Entry


IOC ID:1846418
IOC: https://88.99.120.224
IOC Type :url
Threat Type :botnet_cc
Malware: Vidar
Confidence Level : Confidence level is elevated (75%)
Is compromised? : False
ASN:AS24940 HETZNER-AS
Country:- DE
First seen:2026-07-08 07:39:08 UTC
Last seen:never
UUID:09d092e9-7a9f-11f1-97fa-42010aa4000a
Reporter techjoe
Reward 10 credits from anonymous
Tags:Arkei dead-drop-resolver GCleaner Go-crypter Vidar
Reference: https://github.com/anthropics/claude-code/issues/75517#issuecomment-4912416725

Avatar
techjoe
C2 + Steam/Telegram dead-drop resolvers from a native x64 infostealer embedded (position-encrypted) inside a garble Go crypter/loader (loader SHA256 d85d164e46fabb085609f2586e8fec364539a6ec81f74659f0cb28ac76e7880b; stealer SHA256 dd3b199d255a5f35da02e170f840207ec1b0ce60425a3344bba4da47bfddcfee). Vidar/Arkei lineage; MalwareBazaar sibling samples labeled ArkeiStealer. Delivered via fake 'Claude Code safety-gate bypass patch'.